Forum Discussion
Power BI Report Server with custom authentication error Power Bi Desktop
Hi fabio78,
You’ve used the correct and reliable approach for integrating Power BI Report Server with Custom Authentication and SSAS. By adding CUSTOMDATA={{USERID}} to the PBIRS connection string and referencing it in an SSAS role, you successfully recreate the user context that PBIRS doesn’t provide in Forms mode. Your setup works as intended: the Custom DLL sets the user identity, PBIRS forwards it via CUSTOMDATA, and SSAS applies Row-Level Security through DAX. This method is supported for per-user filtering when EffectiveUserName isn’t available.
Your architecture is solid: PBIRS operates in Custom Authentication mode, the report sends the custom identity in the connection string, and SSAS handles security in the role. This ensures that all security is managed within the semantic layer, not the report. The results you’re seeing, admins having full access and other users being filtered are expected.
To expand this to groups, modify your DLL to capture user groups and pass a normalized value into CUSTOMDATA, such as a group key or list. Then, add a group-to-business key mapping table in your Tabular model and adjust your role DAX to filter using CUSTOMDATA(). This approach keeps authorization logic in SSAS, maintains your custom identity throughout, and avoids unsupported changes in PBIRS.
Thank you.
Thanks for the reply, I now understand that PowerBI Desktop isn't compatible with custom authentication, although it seems absurd that changing the authentication mode is allowed and then some products aren't compatible.
In any case, following your instructions, I wanted to understand one thing:
1. Use Integrated Windows Authentication for PBIRS (supported path). If you need to keep custom authentication, you'll probably need to reinstate/enable Windows Authentication for the report server endpoint used by Desktop.
If I understand correctly, can I keep custom authentication and then define endpoints that Desktop uses with Windows Authentication? Can I manage this from web.config? Do you have any examples?
In the meantime, I've tried to manage everything with my custom DLL, intercepting the call headers, and thus I've managed to handle both custom authentication and calls from the desktop. However, for now, I can't optimally filter the desktop (all are allowed). I still have some work to do, but again, if your point 1 is feasible as I interpreted it, I think I'll go that route.
Thanks again for the reply!!