Row Level Security with PowerBI Embedded

[NickHall]

Hi,

We have several reports that utilise PowerBI Embedded which pull data through an on-premises gateway. This all works great. However, we have reached a stage where we want to use powerbi roles to implement row-level security on a report.

Our goal is to attach a role to users on our site, which is then passed through as part of the identity on token creation, corresponding to the roles defined in the powerbi dataset.

Following the guide here I managed to create a token with an identity:

var generateTokenRequestParameters = new GenerateTokenRequest("View", null, identities: new List<EffectiveIdentity> { new EffectiveIdentity(username: username, roles: new List<string> { role }, datasets: new List<string> { datasetId }) });

var tokenResponse = await client.Reports.GenerateTokenInGroupAsync(groupId, reportId, generateTokenRequestParameters);

This doesn't work however, and returns an error:

Creating embed token for accessing dataset <datasetId> shouldn't have effective identity"

Doing some more research, it seems that I need to attach users to the roles, but due to us using a service principal, there is only one effective user on the report.

I've tried attaching the service principal by going to the dataset in the workspace, opening the menu and selecting security. From there I tried typing the service principal in but it just says it's an invalid email.

I'm really not sure about how to proceed here, so any help would be greatly appreciated. Thanks!

[nandukrishnavs]

@NickHall 

Hope your dataset contains user email ids & your RLS has configured using USERPRINCIPALNAME()

Refer to this blog, for Dynamic RLS configuration.

https://community.powerbi.com/t5/Community-Blog/Dynamic-Row-Level-Security-Dynamic-RLS/ba-p/787399

https://community.powerbi.com/t5/Service/Dynamic-Row-Level-Security-Single-Role-for-all-the-User/m-p...

I understand you are using a service principal account, But you have to pass the actual login user's email id in the below code segment. If you have multiple roles, then you have to switch the role name as well.

Example-

username: username@abc.com

role: roleA

var generateTokenRequestParameters = new GenerateTokenRequest("View", null, identities: new List<EffectiveIdentity> { new EffectiveIdentity(username: "username@abc.com", roles: new List<string> { "roleA"}, datasets: new List<string> { "datasetId" }) });

var tokenResponse = await client.Reports.GenerateTokenInGroupAsync("groupId", "reportId", generateTokenRequestParameters);

Did I answer your question? Mark my post as a solution!
Appreciate with a kudos 🙂

[NickHall]

Hi, thanks for the reply! I think I'm starting to understand the problem.

These reports are being disseminated to users outside of our organisation, and therefore not in our active directory. They are users stored in a SQL database on one of our sites and not in any way tied to MS.

Our goal is to have an embedded report that changes its available data depending on the roles of the user logged into the site. An example of this would be siteUserA has roleA. The PowerBI report has some rows of data that only roleA users should see. When siteUserA reaches our embedded report page, it checks their site roles and then does -something- that tells PowerBI what roles they have within the given report.

Is this possible with rls? If not, is there an alternative?

We have explored creating multiple reports and fetching a different one depending on the role of the user hitting the report page, but this is hugely impractical as we'd need 20+ versions of a single report!

Thanks again,

Nick