Forum Discussion
Row level security doesn't work when using 'Both' cross filter direction
- 7 years ago
We have issued a fix for this issue in the latest build 15.0.1102.235. Please upgrade to the latest build available.
Thanks,
Rohit
We have issued a fix for this issue in the latest build 15.0.1102.235. Please upgrade to the latest build available.
Thanks,
Rohit
I just downloaded and installed the Febuary 2019 Power BI Desktop. I too am having an issue with RSL in my model and for the life of my cannot figure out what is going on. Let me describe the general model layout:
* Fact table (20 million rows) with with a dimension key value.
* Dimension table. Dimension Key is unique (as it should be)
* Security table which lists Users (username@domain) and the Dimension members (dimension key) to which they have access.
* One-to-Many relationship from Dimension table to Fact table, with SINGLE Cross Filter direction
* One-to-Many relationship from Dimension table to Security table, with BOTH Cross Filter direction AND checked the box for "Apply security filter in both directions"
* Security Role defined with the following DAX statement on the Security table: "[UserPrincipalName] = USERNAME()"
In theory, the Security table gets filtered via RLS and the USERNAME() function, and the BOTH Cross Filter direction then filters the Dimension table, which then filters the Fact table.
Now here's the issue: Facts are added (or more likely Dimension members are removed) in such a way that there are orphaned facts that list a Dimension Key that no longer exists. (not my choice for data integrity, but that's the case.)
In THEORY, those orphaned Facts should NOT show up for ANYONE governed by RLS in the Role.
In FACT (no pun intended) the orphaned records show up for EVERYBODY governed by RLS.
I removed Incremental Refresh from the fact table and refreshed it in its entirety, no change.
This is driving me nuts. It's like there is a BUG.
FYI: I moved my RLS DAX Expression to the Dimension table with the following:
CONTAINS (
'Security Table',
'Security Table'[Dimension Key],
USERNAME(),
'Security Table'[Dimension Key],
'Dimension Table'[Dimension Key]
)
and that seems to have fixed it. But still, WHY would the Bi-directional filtering not work?
Any ideas would be appreciated.