RLS workaround - security issues with this solution?

[AlexanderPowBI]

Hello everyone,

I've constructed a report where each "company" can view their measures in comparison to the aggregated measures of all companies within their respective regions and for different attributes. This report encompasses many metrics, and consequently, numerous measures, some of which are quite complex. The report will be embedded to our website, where users will have to log in to view the report, and roles per company_Key which the user belongs to will be set. 

When building the report, I had no experience with RLS and I built it with the thought that when using RLS, the measures built to show aggregated data would work well. However, I discovered that when applying RLS, all other data gets hidden which is not related to the specific role. So, this breaks my report as I need to show “My company data” VS “measures with ALL data”.

I came up with a trick, to bypass this. I want to know if there is any security issues with this solution, and this is why I have made this post.

So what I did was:

• Created a copy of “Company table” which is disconnected to the rest of the model (View model below)
• Created two slicers for Company_Key in the report, one using “Copy of CompanyTable” and one using “CompanyTable”
• Connected the slicers
• Hid the “real” slicer (Company_Table)
• Created RLS with Company_Key, using the Copy of CompanyTable.
• Removed the “analyze in excel” option from the report.

Now, when I try this on the power BI web service, it looks that I have achieved what I want. The disconnected company slicer filters the report by being connected to the real slicer, displaying the report in the way I want it. Also, by disabeling "Analyze in excel", the dataset seems to me protected. 

However, I am not sure what will happen when we embed this into our website.

 - Will there be any security issues where someone who is tech-savy could find the hidden slicer in some way and reveal other “companys” data ? Or is the slicer 100% not reachable as it is hidden?
- Are there any other issues with this solution? 

And here is an overview of what the model looks like:

Thank you!

[lbendlin]

Let a user connect to the dataset via DAX Studio and make sure they don't see the original company table.

[AlexanderPowBI]

Hello and thank you for your reply,

I will check out how to accomplish this, any suggestions on where to read up on this? I have only used DAX studio to connect to desktop versions & gooling i find how to connect it to the power BI service, not embedded versions.
Also, a software developer (with no Power BI knowledge) I asked told me in general, that this may be not safe as data may be acccesable by reverse-engineering the API. Do you know anything about this matter? 

[lbendlin]

There isn't much to it. Connect DAX Studio to your dataset via 

Data Source=powerbi://api.powerbi.com/v1.0/myorg/<workspace name>;Initial Catalog=<dataset name>;

then evaluate the model and its tables  (partitions and expressions)