Forum Discussion

sam87's avatar
sam87
New Member
7 years ago

Power BI User Role Table

I've a requirement to grant users outside of a domain to grant access to run reports.   1) Can we add new roles to the Role table in PowerBI DB tables ? 2) Is there any other way to control access...
Anonymous's avatar
Anonymous
Not applicable
7 years ago

Is it possible to use this to prevent users logged into a website from viewing embedded reports by manipulating the iframe src?  How does an on-prem report server know which user has logged into an external website?

 

Example scenario.

 

  • 2 Reports are created on the report server.
    • Report A
    • Report B
  • Each of the 2 reports require different roles to view.
    • Access A
    • Access B
  • The reports are to be viewed by users on a website.  The reports are embedded in an iframe.
  • User A logs into the website and is greeted with an iframe with a src that defaults to the Report A url
  • User B logs into the website and is greeted with an iframe with a src that defaults to the Report B url
  • User B, while bored,
    • Decides to view the HTML page's source.
    • Changes the iframe's src value to the Report A url
    • The iframe loads Report A

 

Is it possible using an embedded iframe and an on-prem report server to prevent User B from viewing Report A?  How can the website tell the report server who is trying to view the report?

 

Thanks.

Skeletor's avatar
Skeletor
Helper I
7 years ago

Willy,

 

I'm not aware of anyway to manipulate the iframe src to manage permissions.

 

If you are using windows authentication then yes, set permissions based on windows authentication

 

If you are using custom authentication for external users, then users have to login with credentials that you set up and provide them. It's also possible to pass cookies and/or automatically detect which user is grouped into which access group, report A or report B, and then have those credentials automatically entered by the application into the form. If they change URL's, that custom account won't have access to the other report, as long as you dont give it permissions on that one in PBIRS.