Security for SSAS live connection not working

[Anonymous]

I've found an issue in PBI desktop with a live SSAS MD cube connection.

In SSAS we have security roles restricting access to certain measures for different roles. These roles work fine, and when accessing the cube via live connection from PBI desktop from a restricted user, the measures don't show up. So far so good.

If I change an ssas role and add one of the missing measures to a user, it also pops up from PBI for that user.

However, if I change that role and remove the measure again, the measure still remains visible from PBI.

I've double checked the role, and if I connect to the cube via Excel the measure is NOT visible for the user anymore.

But from PBI desktop, even if I create a new live connection from PBI against the same cube, the measure is still there, and shows values. It's like the access to the measure is cached somehow.

Is this something anyone else has noticed? Is this a bug or is there a setting in PBI that I need to change somehow? I've tried clearing the cache from within PBI desktop but that doesn't help either. It's still visible.

This is a pretty serious issue, for us at least. If only granting access to measures in ssas take effect in PBI, but not revoking access.

Do we have anyone out there who knows anything about this, or could test it and see if it applies to you too?

We're on SQL 2014 Enterprise if that's any help.

Thanks in advance!

[kinjalgshah87]

Hi ,

we have provide role in SSAS cube and after i have attached the cube with SSAS Analysis service with connection live in power bi.

But role is not working  is as per user.

So can you give us a suggestion for that?

[v-sihou-msft]

@Anonymous

We reproduced similar issue as yours. When we deny measures in role security, Power BI will still cache the old model schema.

We have reported this issue internally.

Regards,

[Anonymous]

Hi Simon!

Just FYI. I registered the same issue in the issues forum yesterday. Can be found on this link

https://community.powerbi.com/t5/Issues/Security-issue-with-live-ssas-connection/idi-p/113577

[naveend]

Hello Zkrymer,

We are facing same issue..do you any onfo regarding this issue.

Please advise.

Thank you

Naveen D

[Anonymous]

Hi @naveend

Yes I do. Since this was an SSAS issue, it turned out to be a little bit complicated to get a quick fix implemented. Development cycle for SSAS is still a bit slow unfortunately. However, MS finally offered a private fix, to be delivered before the permanent fix could be released for SSAS. With the fix installed the issue seems to be solved. We're still to install the "real" permanent fix for this.

Below is the latest information we got from MS with links to where you can download the fix. Note though that we still haven't implemented the fix this way yet, but hopefully it works the same way as the private one we got earlier. And don't worry that it says SQL2014. This fix is available for other versions as well.

Our fix has been released yesterday evening (8th of august) with  SQL Server 2014 SP2 CU6  and as windows security update CVE-2017-8516.

You can use either.

Problem description: https://support.microsoft.com/en-us/help/4018908

CU download: https://support.microsoft.com/en-in/help/4019094/cumulative-update-6-for-sql-server-2014-sp2

Security patch download. https://support.microsoft.com/en-in/help/4036996/description-of-the-security-update-for-sql-server-2...

[TheLotter2017]

Hi, we face the same problem now. I 've downloaded the CU but it didn't help. If someone solved this problem by CU download https://support.microsoft.com/en-us/help/4018908 ? Thank you for your help, Anastasia.

[naveend]

Hi Zkrymer,

Thank you for the important info.

[TheLotter2017]

Hi Naveend,

we face the same issue now, but microsoft fix didn't help. Did you resolve this problem? Thank you for you help. Anastasia.