Forum Discussion

PBR's avatar
PBR
Regular Visitor
6 years ago
Solved

Is Row-Level Security in Power PBI Embedded Really "Secure" in a Purely Client-Side Application?

Long Time Reader, first Time Poster,   So, imagine a Power BI Embedded App-Owns data scenario where I have a report configured for Row Level Security, and the report shows different data based on t...
Need Help
  • Anonymous's avatar
    Anonymous
    6 years ago

    Hi PBR 

    I have just gone through this same scenario whilst migrating an embedded solution from asp.net core MVC - over to React JS.

    In the App owns data flow, you are right with the fact that 'spoofing' an account/user becomes much easier.

     

    Because of this, I came to the conclusion that creating an API to deal with the creation of tokens/report configuration was the only route forward. My server-side API now validates permissions based on OAuth tokens - and creates an appropriate embed token.

     

    It's frustrating to need an additional server side component - but where security is concerned, it is worth it.

    Hope this helps.

nandukrishnavs's avatar
nandukrishnavs
Community Champion
6 years ago

PBR  - I think if your token type is AAD, then Power BI will handle the RLS part. 
If you are embedding the report using the master account, you have to use .net core to pass the user role. 

Reference links:

  1.  https://github.com/Microsoft/PowerBI-JavaScript/wiki/Embedding-Basics
  2. https://docs.microsoft.com/en-us/power-bi/developer/embedded/embedded-row-level-security#applying-user-and-role-to-an-embed-token



Did I answer your question? Mark my post as a solution!
Appreciate with a kudos 🙂