Forum Discussion
Power BI Report Server with custom authentication error Power Bi Desktop
Hi fabio78,
You’ve used the correct and reliable approach for integrating Power BI Report Server with Custom Authentication and SSAS. By adding CUSTOMDATA={{USERID}} to the PBIRS connection string and referencing it in an SSAS role, you successfully recreate the user context that PBIRS doesn’t provide in Forms mode. Your setup works as intended: the Custom DLL sets the user identity, PBIRS forwards it via CUSTOMDATA, and SSAS applies Row-Level Security through DAX. This method is supported for per-user filtering when EffectiveUserName isn’t available.
Your architecture is solid: PBIRS operates in Custom Authentication mode, the report sends the custom identity in the connection string, and SSAS handles security in the role. This ensures that all security is managed within the semantic layer, not the report. The results you’re seeing, admins having full access and other users being filtered are expected.
To expand this to groups, modify your DLL to capture user groups and pass a normalized value into CUSTOMDATA, such as a group key or list. Then, add a group-to-business key mapping table in your Tabular model and adjust your role DAX to filter using CUSTOMDATA(). This approach keeps authorization logic in SSAS, maintains your custom identity throughout, and avoids unsupported changes in PBIRS.
Thank you.
Hi fabio78,
Power BI Report Server does not natively support accepting external identities from a reverse proxy and treating them as the logged-in user. PBIRS only recognizes Windows Integrated Authentication or its own Custom/Forms authentication extension. If authentication is handled entirely by a reverse proxy, PBIRS cannot use headers or tokens (like X-Authenticated-User) to identify users for permissions, RLS, SSAS EffectiveUserName, or User!UserID in reports. In this scenario, PBIRS will see all requests as coming from a single Windows service account or as anonymous, resulting in the loss of the actual end-user identity. Therefore, a reverse proxy setup is limited: either PBIRS runs in Windows mode with the proxy forwarding all requests as one account, or it uses Custom/Forms authentication, which allows user recognition but prevents publishing from Power BI Desktop due to product limitations. There is no supported hybrid model combining Forms authentication for the portal and Windows authentication for REST endpoints while still maintaining user identity. Given these limitations, your current method, using Custom Authentication in PBIRS, building reports in Power BI Desktop, and uploading PBIX files through the portal, is the recommended and supported approach. User-based filtering should be handled within reports or SSAS using your custom identity (such as User!UserID and a mapping layer), instead of trying to map identities at the server level.
Thank you.