Dynamic Row Based Security

[Anonymous]

I have been following THIS article on how to setup row based security using passed through credentials.

I have two identical (duplicates) tables: Employee, and EmployeeSecurity that consist of the following columns:

• ContactID
• SupervisorID
• EmployeeNumber
• FirstName
• MiddleName
• LastName
• ActiveDirectoryUserName

I have a relationship setup between EmployeeSecurity.SupervisorID to Employee.ContactID.

I currently have a Role setup on the tabulear model that contains these to tables or dimensions with read access.

The Row Filter I am using could probably use some fixing but I'm not sure where:

=Employee[SupervisorID]=LOOKUPVALUE(EmployeeSecurity[SupervisorID],EmployeeSecurity[ActiveDirectoryUserName],USERNAME())

I am trying to make it so employees can see their supervisors, and/or supervisors can see their employees.  I'm hoping someone sees either what is wrong with my DAX or maybe I'm going about settin up the relationship incorrectly.

This is just for functionality practice to prove Dynamic Row Based Security will work for us.

[v-yulgu-msft]

Hi @Anonymous,

According to above tutorial, your DAX filter formula should be:

 =Employee[SupervisorID]=LOOKUPVALUE(EmployeeSecurity[SupervisorID],EmployeeSecurity[ActiveDirectoryUserName],USERNAME(), EmployeeSecurity[SupervisorID], Employee[SupervisorID])

Regards,
Yuliana Gu

[Anonymous]

Thanks for the response @v-yulgu-msft.

I'm wondering if the problem might be a few things together.  Possibly the created relationship with filter direction and a poor understanding of the LOOKUPVALUE DAX.

With the changes you suggested the user received no data.  I altered the DAX to:

=Employee[ContactID]=LOOKUPVALUE(EmployeeSecurity[ContactID],EmployeeSecurity[ActiveDirectoryUserName],USERNAME(), EmployeeSecurity[SupervisorID], Employee[SupervisorID])

And now the user sees SOME data but not his/her own records.

Does anyone have experiance with this, and if so do you have any documentation, examples I can look at?