Forum Discussion
SAP HANA and Row Level Security
Hi mattswindon,
After connecting to SAP HANA database in Power BI Desktop, you can define roles and rules to implement row level security for your dataset, and you will need to add members to defined roles in Service after publishing the Power BI Desktop file.
Moreover, you can take advantage of the DAX function username() within your dataset. You can use it within expressions in Power BI Desktop. When you publish your model, it will be used within the Power BI service. You can take a look at the following article to get more details about row level security in Power BI: https://powerbi.microsoft.com/en-us/documentation/powerbi-admin-rls/.In addition, the article you reviewed is specific to SSAS data source, I am afraid that you are not able to use same technology to map user with SAP HANA.
Thanks,
Lydia Zhang
Hello,
We succed in our organisation to deploy SSO between HANA & PowerBI on DirectQuery mode allowing to read the SAP Roles and getting the correct Data (without RLS) in Azure AD.
1/Action on the SAP Hana Base (Admin/Basis tasks) : Microsoft Docs : https://docs.microsoft.com/fr-fr/power-bi/connect-data/service-gateway-sso-saml : deploy & install on different machine (server Linux, Virtual Machine, pc,..) you may need specific tool (FileZilla, Putty,...)
2/ Action on the Gateway Server (Admin/Basis tasks) : Microsoft Docs : https://docs.microsoft.com/fr-fr/power-bi/connect-data/service-gateway-sso-saml
2bis/ Action on the Admin Portal : Tenant->Integration-> Allows Azure SSO
3/ Action on SAP : create 2 Analytic Privilège on the dedicated view (calculation view) with SQL Script ("BU" = 1 & "BU" = 2) & SESSION_USER. You may need to modiy your view to add the Session_user field.
4/ Action on SAP : create User "Test_SSO_1" with dedicated Roles & Privilèges (Paskcge, Object,..) add the Analytic Privilège BU1, do the same for "Test_SSO_2"
5/ User "Test_SSO_1" must have a SAML External connections : no Login/Password but check the SAML Configuration : Add the Identity Provider & UserPrincipalName (follow the previous Microsoft doc) do the same with "Test_SSO_2" with a different UPN.
6/ Dedicated PBI Gateway "SSO" : create gateway, add Test user (UPN) & test the user on the Gateway "Advanced setting"
7/Test : with a Generic user "BI_ALL" connect via the Desktop to SAP : credential "Database" (not windows), in DirectQuery mode, create a report "SSO_HANA" with axis on which apply Analytical : "BU". The generic user see all the data.
8/Publish this report "SSO_HANA" on dedicated workspace, be sure to use the SSOGateway, give acces to your Test user, they should see only BU=1 & BU=2
It could take half a day for Admin tasks (with appropriate right on the machine) to install a set the SSO & a day to developp a view, analytical privilege, & Roles.
Good luck !