RLS issue

[JinHe]

I follow this guide Generate an embed token with RLS to GetEmbedToken with RLS.

But I encountered a problem. This method reported 400 bad request when executing the following method.

var rlsIdentity = new EffectiveIdentity(
                username: customerId.ToString(), // Customer Id
                roles: new List<string> { "CustomerDynamic" }, // Role name
                datasets: new List<string> { datasetId }
            );
            var tokenRequest = new GenerateTokenRequestV2(
                reports: new List<GenerateTokenRequestV2Report>() { new GenerateTokenRequestV2Report(report.Id) },
                datasets: new List<GenerateTokenRequestV2Dataset> { new GenerateTokenRequestV2Dataset(datasetId.ToString()) },
                targetWorkspaces: workspaceId != Guid.Empty ? new List<GenerateTokenRequestV2TargetWorkspace>() { new GenerateTokenRequestV2TargetWorkspace(workspaceId) } : null,
                identities: new List<EffectiveIdentity> { rlsIdentity }
            );
var embedToken = pbiClient.EmbedToken.GenerateToken(tokenRequest);

 We are developing PBI reports, and currently only one report is configured with RLS, while the other reports are not configured with RLS. Currently all reports that are not configured with RLS are not working. Obviously these reports cannot resolve RLS. How to deal with this situation, can the reports that are not configured with RLS ignore RLS instead of reporting errors?

[v-yiruan-msft · Accepted solution]

Hi @JinHe ,

Base on your description, it seems like you got stuck when generating an embed token with RLS. Could you please check the following info?

• Ensure that the datasets and reports have been configured correctly for RLS. Verify that the dataset IDs and report IDs you are using in the code match the ones configured in Power BI service.
• Generate tokens for reports that do not require RLS separately

• Create separate methods for generating tokens for reports with RLS

  public GenerateTokenRequestV2 CreateTokenRequest(string datasetId, Guid reportId, Guid workspaceId, string rlsRole, string customerId, bool isRLSRequired)
  {
  List<EffectiveIdentity> identities = null;
  
  if (isRLSRequired)
  {
  var rlsIdentity = new EffectiveIdentity(
  username: customerId.ToString(), // Customer Id
  roles: new List<string> { rlsRole }, // Role name
  datasets: new List<string> { datasetId }
  );
  identities = new List<EffectiveIdentity> { rlsIdentity };
  }

  var tokenRequest = new GenerateTokenRequestV2(
  reports: new List<GenerateTokenRequestV2Report> { new GenerateTokenRequestV2Report(reportId.ToString()) },
  datasets: new List<GenerateTokenRequestV2Dataset> { new GenerateTokenRequestV2Dataset(datasetId.ToString()) },
  targetWorkspaces: workspaceId != Guid.Empty ? new List<GenerateTokenRequestV2TargetWorkspace> { new GenerateTokenRequestV2TargetWorkspace(workspaceId) } : null,
  identities: identities
  );

  return tokenRequest;
  }

  var tokenRequest = CreateTokenRequest(datasetId, report.Id, workspaceId, "CustomerDynamic", customerId, isRLSRequired);
  var embedToken = pbiClient.EmbedToken.GenerateToken(tokenRequest);

Best Regards

[JinHe]

@v-yiruan-msft
Thanks for you reply. This is how I solved this problem yesterday, in order to solve the token generation of all reports.

var tokenRequest = new GenerateTokenRequestV2(
    reports: new List<GenerateTokenRequestV2Report>() { new GenerateTokenRequestV2Report(report.Id) },
    datasets: new List<GenerateTokenRequestV2Dataset> { new GenerateTokenRequestV2Dataset(datasetId.ToString()) },
    targetWorkspaces: workspaceId != Guid.Empty ? new List<GenerateTokenRequestV2TargetWorkspace>() { new GenerateTokenRequestV2TargetWorkspace(workspaceId) } : null,
    identities: isPublic ? new List<EffectiveIdentity> { rlsIdentity } : null
);
var embedToken = await pbiClient.EmbedToken.GenerateTokenAsync(tokenRequest);