Sharing dashboards security issue

[jbocachica]

When I'm sharing a dashboard, there is a big big, super big issue, if you are using SSAS Connector and you share your dashboard, you are also sharing your credentials, think about this.

The user1 is the designer of the dashboard, and he have access to all data, the user1 share his dashboard with the user2, however the user2 just have access to some information, that kind of permissions are defined using row security level, a feature available in SSAS, however as the user1 is the designer and he has access without restricctions, the user2 is now able to see the same information as the user1, all your security is down, your users have now the last word to define who have access to the information of the company.

Bad, bad, too bad...

A sadness consultant

[andre]

I am guessing that at GA the correct EffectiveUserName will be passed so that the row level security will work as expected.

[jbocachica]

Well, the EffectiveUserName is not passed and the row level security is not working as expected, even if look into the report, the row level security is bypassed; It's working as an impersonation way...

[andre]

It is not passed in Preview, but it will be working when the product is GA next week.

So to clarify, for the next few days, PowerBI.com will pass the credentials of the user who has created the reports.  When the product goes GA, the credentials of the user who is vewing the reports and dashboards will be passed to the Analysis Services model, so row level security will work as excpected.