Power BI Embedded Composite Model With RLS

[Bahneby]

Hi everyone,

I have two semantic models with RLS. The first semantic model has the RLS "RLS_1" and the second semantic model has the RLS "RLS_2". Then I built a composite model which has a direct query to both semantic models. It's working fine on Power BI Service.

But now, I have to embed it to our website.

Is this scenario even possible? I used the App owns Data example for .Net Core. But I always receive the error "BadRequest".

I changed the GetEmbedToken method:

public EmbedToken GetEmbedToken(Guid reportId, IList<Guid> datasetIds, [Optional] Guid targetWorkspaceId)
{
    PowerBIClient pbiClient = this.GetPowerBIClient();
    var datasetId_1_RLS = Guid.Parse("xxx..xxx");
    var datasetId_2_RLS = Guid.Parse("xxx..xxy");

    var datasetIdsRLS_1 = new List<Guid> { datasetId_1_RLS };
    var datasetIdsRLS_2 = new List<Guid> { datasetId_2_RLS };

    datasetIds.Add(datasetId_1_RLS); // RLS 1
    datasetIds.Add(datasetId_2_RLS); // RLS 2


    var rlsIdentity_1 = new EffectiveIdentity(
        username: "this.isan@example.com",
        roles: new List<string> { "RLS_1" },
        datasets: datasetIdsRLS_1.Select(id => id.ToString()).ToList()
    );

    var rlsIdentity_2 = new EffectiveIdentity(
        username: "this.isan@example.com",
        roles: new List<string> { "RLS_2" },
        datasets: datasetIdsRLS_2.Select(id => id.ToString()).ToList()
    );


    // Create a request for getting Embed token 
    // This method works only with new Power BI V2 workspace experience
    var tokenRequest = new GenerateTokenRequestV2(

        reports: new List<GenerateTokenRequestV2Report>() { new GenerateTokenRequestV2Report(reportId) },

        datasets: datasetIds.Select(datasetId => new GenerateTokenRequestV2Dataset(datasetId.ToString())).ToList(),

        targetWorkspaces: targetWorkspaceId != Guid.Empty ? new List<GenerateTokenRequestV2TargetWorkspace>() { new GenerateTokenRequestV2TargetWorkspace(targetWorkspaceId) } : null,
        
        identities: new List<EffectiveIdentity> {  rlsIdentity_1, rlsIdentity_2 }
    );

    // Generate Embed token
    var embedToken = pbiClient.EmbedToken.GenerateToken(tokenRequest);

    return embedToken;
}

Do you have any idea, what I did wrong?

Thank you!

[AmosHersch · Accepted solution]

This scenario is supported. You can embed a composite model with several connected datasets, each with its own RLS context.

As a general note, if you receive a "bad request" try to see the response body, it sometimes has additional information for the reason Power BI claims it's a bad reques.

The challenge for your scenraio is generating an embed token correctly. For generating an embed token for composite model with DirectQuery connection to additional semantic models (datasets) your request should contain all dataset IDs in the datasets list, and you should specify xmlaPermissions = ReadOnly for them.

See here for example: Embed Token - Generate Token - REST API (Power BI Power BI REST APIs) | Microsoft Learn

In your case you should also add the effective identitiy of each dataset which has RLS.

[Bahneby]

The XmlaPermissions were the problem. It's working fine now, thank you!

[Anonymous]

Hi @Bahneby ,

Here are some offical blogs about how to embed report with RLS. I hope they could help you.

For reference:

Security in Power BI embedded analytics - Power BI | Microsoft Learn

Using standard cloud based row-level security with embedded content in Power BI embedded analytics -...

Best Regards,
Rico Zhou

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.