Need help implementing row-level security (RLS) with embedded analytics

[datavigilante]

Hello all,

It looks like Microsoft just added some functionality to the GenerateToken API so that you can pass additional context for RLS as a part of your embed token:

https://powerbi.microsoft.com/en-us/documentation/powerbi-developer-embedded-rls/

Does anyone happen to have a simple working example of this that they can share?  I just want to pass one user, role and dataset, but I don't know how to determine the dataset ID.

Sorry, if this is a dumb question, but how do I determine what the id is for the dataset of my report?

thanks!

David

[craigduffy · Accepted solution]

I had the same question. Just figured it out: Similar to getting the group Id. In your power bi portal, click on the app workspace. Then select the Datasets tab on top. Select the dataset that matches your report (or view Settings) then copy the guid from the url after /datasets/.  Copy that to your code and that should do it. 

[datavigilante]

That's awesome, thanks Craig.

If you have it working, would you mind sharing your GenerateToken API syntax?

I'm having trouble getting the code provided for the PowerBIEmbedded_AppOwnsData sample to work:

var generateTokenRequestParameters = new GenerateTokenRequest("View", null, identities: new List<EffectiveIdentity> { new EffectiveIdentity(username: "username", roles: new List<string> { "roleA", "roleB" }, datasets: new List<string> { "datasetId" }) });

var tokenResponse = await client.Reports.GenerateTokenInGroupAsync("groupId", "reportId", generateTokenRequestParameters);

Like I said, I will only have one role and dataset.  Also, I don't understand why groupID and reportID are in quotes.

thanks,

David

[datavigilante]

I think that where I am getting stuck is how to define the EffectiveIdentity object.  In my code below, there is a squiggly line under it:

var generateTokenRequestParameters = new GenerateTokenRequest(
                    accessLevel:  "View", 
                    allowSaveAs: null, 
                    identities: new List<EffectiveIdentity> { new EffectiveIdentity(
                        username: "20", 
                        roles: new List<string> { "User" }, 
                        datasets: new List<string> { "07cf5f83-033d-4265-a9a0-5ba476cde601" }) });
var tokenResponse = await client.Reports.GenerateTokenInGroupAsync(GroupId, "a10024dd-907e-4c1c-baed-e12e0a896d6b", generateTokenRequestParameters);

thanks,

David

[craigduffy]

Sorry I didn't get notice earlier of your post. Here is my code that works:

var generateTokenRequestParameters = new GenerateTokenRequest(accessLevel: "view", identities: new List<EffectiveIdentity> { new EffectiveIdentity(username: userId, roles: new List<string> { role }, datasets: new List<string> { DatasetId }) });

                var tokenResponse = await client.Reports.GenerateTokenInGroupAsync(GroupId, report.Id, generateTokenRequestParameters);

Obviously userId, role, DatasetId and GroupId are string variables. Make sure your role is setup in the Power BI workbook.