Problems with security when using Live connection to SSAS Tabular

[hereri]

For one of our customers we have implemented row based security in SSAS Tabular using roles, and then adding members to these roles. When connecting to SSAS Tabular from Power BI the set filters are not having any effect.

After doing some digging with SQL Server Profiler (connected to SSAS) I see that<EffectiveUserName> is set to the service account being used to connect to Tabular (same as Logged In User), *NOT* the UPN of the logged in user. This information is returned in the <CustomData> tag. I have a feeling that this might be related. We are using "On-Premise data gateway" for this customer.

As as side-note, another customer of ours also have row based security (which works), and here the logged in users UPN is returned in the <EffectiveUserName> tag. The major difference is that this customer is still on "Power BI Gateway - Enterprise".

Any clues or hints towards a solution?

[v-qiuyu-msft · Accepted solution]

Hi @hereri,

In your scenario, did your Power BI service login names match your local directory UPN on SSAS side? If not, please check if you set the Mapping User Roles in on-premise data gateway. For more information, see: Map user names.

Also verify the user is not the admin on the server, please refer to AlexeyRusinov's reply in this thread: Enterprise Gateway with Analysis Services not passing logged in users credentials .

If issue persists, please share the detail steps about how you set row level security and the on-premise data gateway version for our analysis.

Best Regards,
Qiuyun Yu

[hereri]

Hi @v-qiuyu-msft, 

Thank you for your reply. I did find the answer to my problem. In the map user functionality you can decide if you want to use EffectiveUserName or CustomData. Since my browser was in Norwegian the translated text completely threw me off and I did not see the relevance between that option, and how Power BI pushed UPN to SSAS. 

Thanks alot for your help 🙂