Forum Discussion

Anonymous's avatar
Anonymous
Not applicable
9 years ago

PowerBi Embedded API Works with RLS!

Hey everyone,    One of my frustrations with the new API is that it did not include RLS capabilities that were present in the old 1.x version.  I noticed that the API has been updated to 2.0.2 and ...
Show and Tell
Tips and Tricks
pbipbj's avatar
pbipbj
Frequent Visitor
6 years ago

Looks like you're putting the company id value inside the username field in the EffectiveIdentity in the embed token.  This must mean that the username value isn't used for actual authentication/authorization in your scenario.  I've found another reference to this ability here:  https://azure.microsoft.com/en-us/updates/power-bi-embedded-rls-ascii-characater-support/

 

Is this username flexibility exclusive to the "Power BI Embedded" Azure resource?  I've tried to do the same thing with the Power BI Service (not Power BI Embdedded) and the REST API rejected my request.  I received a 401 Unauthorized response when trying to embed the report.  When I put my master user UPN back in the username field (of the EffectiveIdentity in the embed token) it started working again.  

 

So, I'm wondering if there is a way to do the same thing (put an arbitrary value in the username field) without using Power BI Embedded.  CUSTOMDATA() doesn't work for me because I'm not using Azure Analysis Services.

 

Thanks for any info or guidance.

pbipbj's avatar
pbipbj
Frequent Visitor
6 years ago

FYI.  I was able to figure out my issue.  Previously, the report was shared with the master user account.  This situation required the EffectiveIdentity in the embed token to have the master user username.  We couldn't use it for dynamic RLS.  Then we moved the report to a workspace for which the master user is an admin.  After that, the username could be used for dynamic RLS (i.e., username could contain a value other than the master user username).  So that was the difference.  Shared reports couldn't use dynamic RLS.

  • shaunwilks's avatar
    shaunwilks
    Helper V
    6 years ago

    We have had similar issues in the past using RLS within the REST API.

     

    We are using the API in a "User Owns Data" model.  When we open the report we want that report to auto filter using the RLS identifier that we pass to the openinfg the report via the API.

     

    It would seem this is what you are saying you have achieved. In my testing I am the only user account involved. Report is published to my Workspace - so I am an admin.

     

    Could you possibly paste in some code extracts within your API of your call to the report and how youy past the RLS name ? Thanks in advance

    • pbipbj's avatar
      pbipbj
      Frequent Visitor
      6 years ago

      This is the approach we used, which is taken from Microsoft's code in their embed tool (https://app.powerbi.com/embedsetup/appownsdata).  If you're in the User Owns Data scenario, there is an embed tool for that scenario too:  https://app.powerbi.com/embedsetup/userownsdata

      The tool will send you a Visual Studio solution that demonstrates the use of their API.

      If this still doesn't work for you, try publishing the report to a workspace other than "My Workspace" (one for which you're still an admin).  

       

                  try
            {
                using (var client = new PowerBIClient(new Uri(API_URL), tokenCredentials))
                {
                    PBI.Report report = await client.Reports.GetReportInGroupAsync(workspaceId, reportId);
                    if (report == null)
                    {
                        return null;
                    }

                    var datasets = await client.Datasets.GetDatasetByIdInGroupAsync(workspaceId, report.DatasetId);

                    GenerateTokenRequest generateTokenRequestParameters;

                    var username = await GetUsernameValue();
                    if (!string.IsNullOrWhiteSpace(username))
                    {
                        string roles = "RoleA,RoleB";
                        var rls = new EffectiveIdentity(username, new List { report.DatasetId });
                        if (!string.IsNullOrWhiteSpace(roles))
                        {
                            var rolesList = new List();
                            rolesList.AddRange(roles.Split(','));
                            rls.Roles = rolesList;
                        }
                        // Generate Embed Token with effective identities.
                        generateTokenRequestParameters = new GenerateTokenRequest(accessLevel: "view", identities: new List { rls });
                    }
                    else
                    {
                        // Generate Embed Token for reports without effective identities.
                        generateTokenRequestParameters = new GenerateTokenRequest(accessLevel: "view");
                    }

                    var tokenResponse = await client.Reports.GenerateTokenInGroupAsync(workspaceId, report.Id, generateTokenRequestParameters);
                    if (tokenResponse == null)
                    {
                        return null;
                    }

                    return new EmbedConfig()
                    {
                        EmbedToken = tokenResponse,
                        EmbedUrl = report.EmbedUrl,
                        ReportId = report.Id
                    };
                }
            }
            catch (HttpOperationException ex)
            {
                return null;
            }