Issues accessing app connected to external dataset with RLS

[BMassey]

Hello!  Here is my scenario:

We have a working app today that's built from a dataset and dashboard reports that all reside on a single workspace.  We've been working to implement a couple of items:

• Separating our dataset from our dashboards/reports, so the dataset can be centralized and used by multiple other projects.
• Implementing row level security into our model

Last night we attempted to make this switch over.  Here is what the new set-up looked like:

• Workspace 1 has our dataset, which we recently implemented row level security.  Two security levels:
  • Filter by user role
  • No Filtering
• Report published to Workspace 2, connected to dataset from Workspace 1
• Both workspaces have been upgraded to the new version
• All users are internal to the org
• Users don't have direct access to the workspace
• When publishing the app, all app users were added under Permissions=>Access
• After publishing, I had access to the app but users said they didn't.  One screen shot show the left menu loaded, but no dashboard report links were listed under the top-level menu.

I tried two things to resolve the issue:

• These users should have full access to the data and I realized I had not added them to either role.  So, I added them to the "No Filter" role.  That didn't seem to resolve the issue.
• Another user sent me a screenshot and the error said they must have permission to the underlying dataset.  So, I checked this box here and re-promoted the app.  

I figured the combination of these two updates would resolve the issue but users still said they couldn't access the reports.  The two changes above were both made pretty quickly so I'm also wondering if maybe I didn't give it enough time for these changes to propogate, as we ended up rolling back the changes shortly after these two updates above were made and users said they still couldn't access the reports.   

I noticed that once I rolled back these updates and restored their App back to the original set-up (imbedded dataset with no RLS and all on one workspace) users initially still couldn't access the app but after about five minutes it started working.  So, this made me think that maybe I just pulled the plug too quickly on the original two changes I had made, trying to get the new set-up working.  Did I miss something else with the set-up of the new app structure or did we just pull the plug too quickly on these changes?

[BMassey]

We did some more experimenting and troubleshooting today.  We were able to get the users access by adding them as "viewers" to the workspace that the dataset resided in. 

So, it seems there are three spots to update access for this use case:

• Give them access to the app, when publishing it
• Add them to the appropriate role, within the row level security set-up
• Make sure they have "view" access to the workspace the dataset resides on

The above solved our access issue, but seems like a lot of different spots that have to be updated for each user.  Does this seem right or have we made this scenario more complex than it needed to be?