The documentation (https://learn.microsoft.com/en-us/rest/api/power-bi/embed-token/generate-token#examples) contains quite some examples on how to generate a token. But our use case does not seem to be documented. We are confused whether we are trying to use dynamic RLS in the wrong way. Or are just generating our embedded token incorrectly.
Our token request looks as follows:
{
"datasets": [
{
"id": "3bff762b-...-1e1dabe41b3e"
}
],
"reports": [
{
"id": "e16f0244-...-97ceda22e823"
}
],
"targetWorkspaces": [
{
"id": "beca21a6-...-17f65322eb31"
}
],
"identities": [
{
"username": "user.name@domain.be",
"datasets": [
"3bff762b-...-1e1dabe41b3e"
],
"roles": [
"EMAIL"
]
},
{
"username": "BusinessDefault",
"datasets": [
"3bff762b-...-1e1dabe41b3e"
],
"roles": [
"CompanyCode"
]
},
{
"username": "Default",
"datasets": [
"3bff762b-...-1e1dabe41b3e"
],
"roles": [
"DomainCode"
]
},
{
"username": "Business",
"datasets": [
"3bff762b-...-1e1dabe41b3e"
],
"roles": [
"SystemCode"
]
},
{
"username": "Administrators",
"datasets": [
"3bff762b-...-1e1dabe41b3e"
],
"roles": [
"DatabaseRole"
]
}
]
}
This results in the API responding with following error:
Status: BadRequest (400)
Response: {"error":{"code":"InvalidRequest","message":"Multiple identities provided for dataset 3bff762b-c82b-4256-9ed2-1e1dabe41b3e"}}
We've tried removing the datasets parameter in the identities, only provide it to one identity, ... But every possible scenario gives us an exception when generating the token.
When just using one identity, the token generates fine. But the moment we add a second identity. Things no longer seem to work.
Our report datamodel looks as follows:
- Any datasource should be filtered on the current DomainCode (consider this a tenant or organization unit)
- We are reporting on the 'Actions' table. A user should only be able to see the 'Actions' which he is assigned to. Unless if he has the DatabaseRole "Administrators". An Administrator can see every users his information.
- Our 'Actions' have a related table 'CompanySites'. A CompanyCode can be associated to multiple CompanySites.
- The user can see all the 'CompanySites' to the provided CompanyCode
- The report has a slicer where the user can filter on a selected CompanySite
