Rls not working on embedded

[mvarela]

Hi,

I have a report in power bi embedded that had been working ok for months. It uses rls for security on custmers information. For this, it uses a dax formula to apply on a table : 

[ML_Id_CodeKey] IN SELECTCOLUMNS(
FILTER(
'Fact_RelCustomerLab',
RELATED(Dim_CustomerLog[CL_Id_CodeLog])=CONVERT(USERPRINCIPALNAME(),INTEGER)
),"ML_Id_CodeKey",
'Dim_LABS'[ML_Id_CodeKey]

)

I needed to filter DIM_LABS and the direction of the relationship was the opposite, so I needed the formula. This formula was working just fine but since this morning is not working anymore in power bi embedded, but it's still working on Desktop.

Has been any updates recently that may have affected to this behaviour?

I have other reports that uses the typical [customer]=USERPRINCIPALNAME() and they still work ok.

Thanks

[belvoir99]

@mvarela - you are not alone today! See my post - https://community.powerbi.com/t5/Issues/Security-roles-not-working-properly-after-Fall-2021-update/i...

We have raised a support ticket via Power BI Pro and Azure twitter. We haven't yet heard anything. I have the same code structure as you (I learned this from Reza Rad - so I'm going to reach out to him), so that looks like the problem. According to someone else a simple x = y type statement is fine.

[mvarela]

Thanks for letting me know! I guess there's something wrong with the update

[belvoir99]

@mvarela Desktop update? I thought that too, so I rolled back and installed an unrefreshed pbix file from July. Still the same problem. 

So the issue is some background updates that MS have done to Power BI Embedded in the Service, not in the Desktop. It clearly impacts certain forms of RLS and not others.

My service to hundreds of users is now down, first time in 3.5 years it's been unavailable. ☹️ I hope they fix it real soon. Comms is not their strong point, but they do fix disasters pretty quickly and this is a massive disaster. They have almost breached GDPR law for me by exposing some customers' data to other customers. Fortunately we picked it up before our customers found out.

[mvarela]

I don't think it's a problem with desktop, because my rls still works on desktop but don't in embedded.
Luckily this issue only affects to one of our reports and I could quickly made a workaround removing the dax formula and changing the data model a bit so I can use a more simple filter like user=USERPRINCIPALNAME() and it seems to work that way.

I think it don't have to do with calculated columns but on any complex dax calculation used in rls

[belvoir99]

@mvarela - yes agree with all your points. It's in the Service and relates to complex DAX expressions.

I've asked for some comms from MS btw on the other thread. Hopefully they'll provide info that's a bit more than 'Investigating'....

[belvoir99]

@mvarela - my colleague will be engaging directly with MS tomorrow on this. I'll give you an update if there's any news. They are fact-finding at the moment and reviewing with their team.

[v-cazheng-msft]

Hi @mvarela @belvoir99 

Based on your discussion, it seems that some updates on Service caused this kind of issue. Sometimes the update will bring some compatibility issues. Have you ever tried to update the RLS to original Dax formula with October updated Desktop and then override the report in Service?

Best Regards,

Community Support Team _Caiyun Zheng

[tomlitt]

I'm working with @belvoir99 on our product.

We supply the user in the Service via Effective Identity, since we're embedding our report into our website for the "apps owns data" / "embed for your customers" style experience.

We haven't made any changes to the token generation code, which came from Microsoft sample code since 2018; if the APIs have changed could this be a problem?

Another thing to consider; we have one "role" and we decide dynamically what affect that role has on our data based on who the user is via a "user -> organisation" mapping table thus:

[SchoolID] IN

SELECTCOLUMNS(

FILTER(SchoolUser,

SchoolUser[UserSchoolDashboard_Id]=

USERNAME()),

"SchoolID",

[SchoolID])

I have an active support ticket to help resolve this now, just posting this for information to others in case it's useful, or in case they find out why the behaviour has now changed.

[belvoir99]

@v-cazheng-msft installed October desktop update, opened pbix, refreshed it, saved it and published it to the cloud. Problem still there, so not fixed in the October desktop update unfortunately. As you said, there were code changes in the Service so that is still our number one likely cause.

let me know if any progress....? thanks.