Forum Discussion

porterm3's avatar
porterm3
Frequent Visitor
4 years ago
Solved

Link Sharing with Row Level Security

I noticed that when RLS is implemented and a link is sent to someone via subscription, RLS does not work on the first view, and the user can see everything.  Upon refreshing or clicking the link again the users see what they are supposed to.

 

Similar behavior takes place if a user is given direct access and are provided access via link copied out of the browser of someone with higher access levels.

 

I am still testing other link sharing approaches, but was curious if there is a recommended link sharing method for reports with RLS.

 

Thanks

Mike

Data Protection
Need Help
  • porterm3's avatar
    porterm3
    4 years ago

    Just checking back in with the solution on this.

     

    It turns out that we believe the users who reported the issue were actually seeing what they were supposed to see and just didn't realize it.

     

    The reason the issue persisted in our internal testing is because we were removing people from the workspace just before assigning RLS and testing.  We met with our Microsoft reps on this and it turns out that you need to wait at least 1 hour after removing someone from a workspace before assigning RLS.  This has to do with a permissions job that runs hourly.

     

    Thanks everyone for your help.

8 Replies

  • porterm3's avatar
    porterm3
    Frequent Visitor
    4 years ago

    It still isn't clear to me what is going on.  I ran a test yesterday with 8 users, 6 of which the RLS worked on and 2 it did not until the page was refreshed.  These were users who have never looked at the report before and had never been granted access to the workspace.  The link was provided by giving the users Direct Access and then creating a link for "People with Specfic Access" and emailing that link.

     

    Why would RLS fail under these circumstances in 2 of 8?  Isn't that a really big problem?

    • GilbertQ's avatar
      GilbertQ
      Super User
      4 years ago

      Hi porterm3 


      When sending out links what I have found is that the users have to click on the link to get the access has been granted.

  • GilbertQ's avatar
    GilbertQ
    Super User
    4 years ago

    HI porterm3 

     

    This sometimes happens if the report is cached.

     

    What I typically do is to share reports via an App. Because the user clicks on the app link it will then first see their RLS permissions and then show them the valid data.

    • porterm3's avatar
      porterm3
      Frequent Visitor
      4 years ago

      Thanks GilbertQ 

       

      Does it mean anything that query caching is turned off in the dataset settings?

       

       

    • porterm3's avatar
      porterm3
      Frequent Visitor
      4 years ago

      So I tried the app approach and we still had a test this morning where a user saw everything and then upon refresh, RLS kicked in.  Any thoughts GilbertQ ?

      • GilbertQ's avatar
        GilbertQ
        Super User
        4 years ago

        Hi porterm3 

         

        The only thing I can think of is if there is some caching happening on your network for this to happen.


        When I do this with my internet connection I do not see this happening.

  • porterm3's avatar
    porterm3
    Frequent Visitor
    4 years ago

    Just checking back in with the solution on this.

     

    It turns out that we believe the users who reported the issue were actually seeing what they were supposed to see and just didn't realize it.

     

    The reason the issue persisted in our internal testing is because we were removing people from the workspace just before assigning RLS and testing.  We met with our Microsoft reps on this and it turns out that you need to wait at least 1 hour after removing someone from a workspace before assigning RLS.  This has to do with a permissions job that runs hourly.

     

    Thanks everyone for your help.