Hosting shared secure embedded dashboards in a web app (user owns data)

[kakkaroolari]

I've been assigned a task to embed Power BI dashboards to a web app (on-premises, AspNetCore app). I am the developer and an administrator of this app.

Use case:

- big boss has a Power BI pro licence

- big boss creates a dashboard in Power Bi

- big boss assignes a AD security group to limit who can view the dashboard

- big boss shares, or publishes the dashboard

- big boss opens our web-app and saves the dashboard url into the app

- then, anyone in the company who is assigned to the security group can view the embedded Power BI dashboard in out web-app

I have been studying example code here.

From the requirements specified in this question,

quote:

-If you're not signed up for Power BI Pro, sign up for a free trial before you begin.
-If you don’t have an Azure subscription, create a free account before you begin.
-You need to have your own Azure Active Directory tenant setup.
-You need Visual Studio installed (version 2013 or later).

My background:

- I have a Power BI Pro licence

- Our enterprise has an Azure subscription, but I am not the master account administrator

- Our enterprise has an Azure Tenant which I also use to Authenticate users to the web-app.

- I have Visual Studio 2017

I'm having difficulty putting it together.

Tutorial says Embedded dashboard needs to be created in an "app workspace", however, I have no control on what workspace these dashboards are created (different people, different companies, sub-divisions, etc..)

Questions:

1. Is it possible for my app to show secured embedded dashboards/reports made by other people and do the viewer autorization by the API (to avoid iframe double login that also brakes)

2. How can I figure out the "Dashboard ID" and/or the "Group ID" from a random ass shared report link (uid's faked):

https://app.powerbi.com/reportEmbed?reportId=1512aba7-7d1b-4883-a864-c1b7d0e2a4be&autoAuth=true&ctid=5d9c7606-6d50-4220-80a4-00dfd55d92c2

3. To get a view token, do I need to use "GenerateTokenInGroupAsync" or "GenerateTokenAsync", or am I screwed since for any tried ID's all I'm getting is NotFound / Forbidden

4. My web app already has an Azure application "counterpart" (for Azure AD login), must I use that as the Authorization API application Id, or does the Azure application need to be somehow linked to our enterprise's Power BI licence, or some existing Azure app?

5. Is an "Azure app owning the data" even applicable here because I have no control who creates the dashboards and into what app workspace

6. We have a Azure tenant which we use for authenticating users inside our web-app, do we use the same tenant with Power BI API, or is an another tenant needed, or is there any need to involve the tenant here since the user is already authenticated?

Sorry for the long post, but there's million unknowns in my head trying to figure this out.

I'm also probably wrong in my thinking, terminology, so guidance in any misconfig in my head would be appreciated.

Thanks.

[Zilliox]

Hi,

i have been reading your request and unfortunately I can't answer it. But I am wondering if you found the solution ?

I would need the service you are describing. I want to be able to share report to users who don't have a power bi licence. I want to be able to publish my report on a platform and give access to anyone that I authorises.

do you know someone who provide this service, please?

thanks

[kakkaroolari]

We got some kind of report embedding to work, if I remember right. That development discontinued though since.

I think after the user had authenticated to our internal web portal, an access token to the power bi service (API) was obtained by using GetAccessTokenOnBehalfOfUser (from the Microsoft.Identity.Client library) in the backend.

Also, we obtained an enterprise license (to power bi) which enables everyone in the company to "read" reports without the pro license.

With external customers this would not have worked without alternate trickery. I think we have one solution that company called Optisigns has a product to share content to external viewers.