Rowlevel Security Issue when comparing with parent value?

[itsmebvk]

Hi Folks,

I am facing some issues with row level security, hope you can give me a direction to fix this issue.

I have a report with three measures one Location_Measure , State_Measure and Location Vs State Profit. Location Vs State Profit measure  is calculating my Location share in state total Profit. I have a row level security applied on Location,

when a location manager check the report they should be only able to see Profit for that location and this location contribution% to total state profit. This is working fine in desktop when we publish it to service and when the location manger check the report its  not showing Location Vs State Profit correctly because of security on location.

CALCULATE([Profit]

,all(location_RLS)

,all(location_dim)

,values(location_Dim[stae]))

Can you please suggest if there are anyways to overcome this issue?

Thanks in advance.

[selimovd]

Hey @itsmebvk ,

how does the RLS look like?

Is he able to see the details of location and state?

Best regards

Denis

[itsmebvk]

HI @selimovd 

yes, that location manager able to see location number and state name. But because of his login both location and state level measure is showing same value.

Thank you.

[selimovd]

Hey @itsmebvk,

and let me guess, he should see the total of the state, but only the total but no details from other locations? 

Best regards

Denis

[itsmebvk]

@selimovd  That's exactly what I am looking for.

[selimovd]

Hey @itsmebvk ,

that's a little bit of an issue.

So if you use row level security, then the rows that a person should not see are gone when we is opening the report. This means also the total of a specific row is only the total of what he is allowed to see.

If you want him to only the the total, but no details, then you have to make sure the DAX measures ALWAYS consider the total and he has chance to change the report and for example use the column that you don't want him to see details. This is not security, this is you trying to hide existing information from him.

If the user only has viewer permission and no build permission, then it could work. But if the user ever gets build permisson on the data set or if you or another report creator create a measure that does return details on this column, then he will be able to see everything. So you can try that approach, but this approach is dangerous as you have to make sure he will never be able to see the values.

If you need any help please let me know.
If I answered your question I would be happy if you could mark my post as a solution ✔️ and give it a thumbs up 👍

Best regards
Denis

Blog: WhatTheFact.bi
Follow me: twitter.com/DenSelimovic