Composite model with RLS

[NoorAlfar]

Hi,

I'm trying to test the RLS for my model which has 2 datasets in direct query mode, The original datasets (imported method) have the RLS applied to them and configured on the service, but when I try to test the RLS for the model that has both datasets it fails and gives me this error:

Please try again later or contact support. If you contact support, please provide these details.

the RLS is working on the original models and there is no conflict between them

[Anonymous]

Hi @NoorAlfar ,

Can you please share a pbix or some dummy data that keep the raw data structure with expected results? It should help us clarify your scenario and test to coding formula.

How to Get Your Question Answered Quickly  

Regards,

Xiaoxin Sheng

[NoorAlfar]

Hi @Anonymous 

All my datasets are in direct query mode, after configuring the RLS on power service, I changed the role type for the user email to a viewer role

my issue now is when embedding the report, it gives this:

I'm testing now on static RLS this is a snapshot of the code:

private async Task<EmbedToken> GetEmbedToken(IList<Guid> reportIds, IList<Guid> datasetIds, [Optional] Guid? targetWorkspaceId)
    {
        var pbiClient = this.GetPowerBIClient();

        var reports = reportIds.Select(reportId => new 
                      GenerateTokenRequestV2Report(reportId)).ToList();

        var datasets = datasetIds.Select(datasetId => new 
                    GenerateTokenRequestV2Dataset(datasetId.ToString(), 
                    XmlaPermissions.ReadOnly)).ToList();

        var internall = new List<EffectiveIdentity>() {
            new EffectiveIdentity {
              Username = "AAA",
              Roles = new List<string>(){ "Internal" },
              Datasets = datasetIds.Select(x => x.ToString()).ToList()
            }
        };     

        var tokenRequest = new GenerateTokenRequestV2(datasets: datasets,
                    reports: reports,
                    targetWorkspaces: targetWorkspaceId != null ?
            new List<GenerateTokenRequestV2TargetWorkspace>() {
        new GenerateTokenRequestV2TargetWorkspace(targetWorkspaceId.Value) } 
                 : null,
                  identities: internall);
      
             var embedToken = 
               await pbiClient.EmbedToken.GenerateTokenAsync(tokenRequest);

        return embedToken;
    }

[AmosHersch]

Hi @NoorAlfar ,

The error usually indicates that Power BI tried to query the data from one of your datasets but failed. This can happen if for example the user doesn't have sufficient permissions to access the dataset or if the RLS context provided in the embed token for the problematic dataset was wrong.

Do all of your datasets have the same RLS configuration (usernmae + role) ? Speficifically the one which the dataset with direct query is connected to. From the code it seems you provide the same effective identity to all datasets

[NoorAlfar]

Hi @AmosHersch 

The datasets all have the same role and username 

I'm testing on one dataset now and I still have the same issue, for this dataset on power service I added my email to the security> role> I added my email (have all the permissions) and another email with build and view permissions

when I test it it works fine

for the report I want to embed it is not working, the problem is happening just through loading the report in frontend side after request succeeds

[AmosHersch · Accepted solution]

Hi @NoorAlfar ,

I can't spot an issue in your code above. I tried looking at some traces using the request ID in the error message you got and it seems that the effective identities aren't filled correctly in the GenerateTokenAsync request.

I suggest you try to see using network capture/debugger how the request to generate the embed token looks like and maybe you can spot what's wrong with it. Maybe the dataset IDs list isn't sent correctly?

You should probably make sure you are using one of the latest version on the C# SDK.

Using a single dataset with RLS for finding what's wrong is surely a better approach.

If you can't find anything wrong then I guess next step is creating a support ticket.