Problem with PBI embedded + app only auth + RLS

[MichaelBluth]

I have a report where I've created a role "customer" with DAX expression "[ColumnName] = USERNAME()". I'm trying to get an embed token for this report through the C# API using app only auth:

string applicationId = "***", applicationPassword = "***",
  datasetId = "***", groupId = "***", reportId = "***";

var context = new AuthenticationContext("https://login.microsoftonline.com/tenantId/");
var clientCredential = new ClientCredential(applicationId, applicationPassword);
var result = context.AcquireTokenAsync("https://analysis.windows.net/powerbi/api", 
  clientCredential).Result;
var authHeader = new TokenCredentials(result.AccessToken, "Bearer");
var client = new PowerBIClient(new Uri("https://api.powerbi.com"), authHeader);
var tokenRequest = new GenerateTokenRequest(TokenAccessLevel.View,
  datasetId, new EffectiveIdentity("42", new List<string> { datasetId },
  new List<string> { "customer" }));
var embedToken = client.Reports.GenerateTokenInGroupAsync(new Guid(groupId),
  new Guid(reportId), tokenRequest, cancellationToken: CancellationToken.None).Result;

When I call the GenerateTokenInGroupAsync method, I get a Bad Request error with the following message: "InvalidRequest: Creating embed token for accessing dataset <datasetId> shouldn't have effective identity". What am I doing wrong here?

Thanks in advance

[lbendlin]

My takeaway from the presentation today is that RLS is not supported in the "App owns data"  model.

https://github.com/PowerBiDevCamp

[MichaelBluth]

I looks like that might be the case.. Do you have any advice for an approach in my case where we'd like to offer embedded reports to our customers - we're looking at starting with one report with a dataset containing all customers' data. What is the "correct" approach for this case? One report, but with a unique dataset for each customer?