Row Level Security Embedded Testing Options

[Kornholio1313]

Hello Community!

I have a dashboard in PBI that we are going to embed into our application for external customers. I have the correct license., PPU.

I have a semantic model with RLS applied as follows:

Role=Company Token

Table=Portal

Filter Data=portal[CompanyToken]=USERNAME().

I have used the embedded playground with this to test. The report shows up fine, but I have no idea how to test the RLS with a username as a token #.

Is there a way to test the RLS works, by entering a token in the code? I have tested in the PBI desktop that viewing by a specific token that the data changes and is showing the right client data, but i have no idea how to do this outside of desktop? I am totally new to embedded PBI work and there are so many rabbit holes i have been down, so this is why i am here now. thanks

[v-kaiyue-msft · Accepted solution]

Hi @Kornholio1313 ,

When you're ready to embed the report into your app, you need to generate an embed token. To generate a token using the Embed Token API, pass the following information to the API.

• username (required) – If the roles are dynamic, the username string is used as the filter. For static roles, the username doesn't affect the RLS and can be any string at all. Only a single username can be listed.
• roles (required) – The role(s) used when applying Row Level Security rules. If passing more than one role, they should be passed as a string array.
• dataset (required) – The dataset that is applicable for the item you're embedding.

You can now embed the report into your app. The report filters data according to the RLS applied.

public EmbedToken GetEmbedToken(Guid reportId, IList<Guid> datasetIds, [Optional] Guid targetWorkspaceId)
    {
        PowerBIClient pbiClient = this.GetPowerBIClient();

       // Defines the user identity and roles.
        var rlsIdentity = new EffectiveIdentity(
            username: "France",
            roles: new List<string>{ "CountryDynamic" },
            datasets: datasetIds.Select(id => id.ToString()).ToList());
        );
       
        // Create a request for getting an embed token for the rls identity defined above
        var tokenRequest = new GenerateTokenRequestV2(
            reports: new List<GenerateTokenRequestV2Report>() { new GenerateTokenRequestV2Report(reportId) },
            datasets: datasetIds.Select(datasetId => new GenerateTokenRequestV2Dataset(datasetId.ToString())).ToList(),
            targetWorkspaces: targetWorkspaceId != Guid.Empty ? new List<GenerateTokenRequestV2TargetWorkspace>() { new GenerateTokenRequestV2TargetWorkspace(targetWorkspaceId) } : null,
            identities: new List<EffectiveIdentity> { rlsIdentity }
        );

        // Generate an embed token
        var embedToken = pbiClient.EmbedToken.GenerateToken(tokenRequest);

        return embedToken;
    }

More detailed information can be found at the link:

Using standard cloud based row-level security with embedded content in Power BI embedded analytics -...

Power BI Embedded: Convention-based dynamic Row-level Security | endjin - Azure Data Analytics Consu...

If your Current Period does not refer to this, please clarify in a follow-up reply.

Best Regards,

Clara Gong

If there is any post helps, then please consider Accept it as the solution  to help the other members find it more quickly.

[Kornholio1313]

Thanks Clara. So in my instance where would i put the name of the dataset below, mine is called 'portal'? My Role=Company Token. My username in the RLS is =()

[Kornholio1313]

OK, i was able to generate the code, at least without RLS, but I am at the point where I need the HEAD and the BODY to enter in. From the Embed code i generated from the Power BI Embedded Playground, it doesnt show where to place that in the external URL for the HEAD and the BODY?