Solved: Implementing RLS for embedded analytics with an in...

sramsey · ‎12-11-2017

Hi,

We're trying to embed power BI into our core web app using azure, and had a previous incarnation in place using the old workspace collections (for demo purposes). We've now come back to this project with intentions to get it into production after developing a range of dashboards to find that way of embedding has been deprecated.

We've managed to get our reports exposed through the app using the azure Power BI Embedded resource, but we're now having issues with RLS.

Previously we had set a role to be [Client ID] = USERNAME(), and then set the username to be the ID of the client whose context the user is in. Now we're unable to do this because username is actually used in order to authenticate (so cannot be replaced by the client ID).

Is there any way to refine the dataset (securely) to a specific identity?

Thanks

Eric_Zhang · ‎12-11-2017

@sramsey wrote:

Hi,

We're trying to embed power BI into our core web app using azure, and had a previous incarnation in place using the old workspace collections (for demo purposes). We've now come back to this project with intentions to get it into production after developing a range of dashboards to find that way of embedding has been deprecated.

We've managed to get our reports exposed through the app using the azure Power BI Embedded resource, but we're now having issues with RLS.

Previously we had set a role to be [Client ID] = USERNAME(), and then set the username to be the ID of the client whose context the user is in. Now we're unable to do this because username is actually used in order to authenticate (so cannot be replaced by the client ID).

Is there any way to refine the dataset (securely) to a specific identity?

Thanks

@sramsey

I don't know where you get the idea the username is for authentication, in the case Embedding for your customers, you still assign username and role when generating the embedded token. See Use row-level security with Power BI embedded content.

The correlated REST API is GenerateToken.

View solution in original post

Eric_Zhang · ‎12-11-2017

@sramsey wrote:

Hi,

We're trying to embed power BI into our core web app using azure, and had a previous incarnation in place using the old workspace collections (for demo purposes). We've now come back to this project with intentions to get it into production after developing a range of dashboards to find that way of embedding has been deprecated.

We've managed to get our reports exposed through the app using the azure Power BI Embedded resource, but we're now having issues with RLS.

Previously we had set a role to be [Client ID] = USERNAME(), and then set the username to be the ID of the client whose context the user is in. Now we're unable to do this because username is actually used in order to authenticate (so cannot be replaced by the client ID).

Is there any way to refine the dataset (securely) to a specific identity?

Thanks

@sramsey

I don't know where you get the idea the username is for authentication, in the case Embedding for your customers, you still assign username and role when generating the embedded token. See Use row-level security with Power BI embedded content.

The correlated REST API is GenerateToken.