No PowerBI Create Sample + Forbidden Error

[Elderin]

Hi all,

I've run into some difficulty when trying to add a "create report" option to our "app owns data" website.  I was successfully able to implement the view report functionality based on the sample found here https://github.com/Microsoft/PowerBI-Developer-Samples, but I can't find an example of server-side code for allowing end users to create reports.

I've set the application's permissions in Azure as detailed here https://powerbi.microsoft.com/en-us/documentation/powerbi-developer-register-app/#apply-permissions-... After modifying the code to connect for a create token, I got a "Forbidden" error.  Here's the code I'm using:

                var credential = new UserPasswordCredential(this.AppConfig.PowerBI_ServiceUsername, this.AppConfig.PowerBI_ServicePassword);

                // Authenticate using created credentials
                var authenticationContext = new AuthenticationContext(this.AppConfig.PowerBI_AuthorityUrl);
                var authenticationResult = await authenticationContext.AcquireTokenAsync(this.AppConfig.PowerBI_ResourceUrl, this.AppConfig.PowerBI_ClientId, credential);

                if (authenticationResult == null)
                {
                    model.EmbedConfig.ErrorMessage = "Authentication Failed.";
                    return View(model);
                }

                var tokenCredentials = new TokenCredentials(authenticationResult.AccessToken, "Bearer");

                // Create a Power BI Client object. It will be used to call Power BI APIs.
                using (var client = new PowerBIClient(new Uri(this.AppConfig.PowerBI_ApiUrl), tokenCredentials))
                {
                    string roles = "Default";

                    var rls = new EffectiveIdentity("24", new List<string> { this.AppConfig.PowerBI_DataSetId });
                    if (!string.IsNullOrWhiteSpace(roles))
                    {
                        var rolesList = new List<string>();
                        rolesList.AddRange(roles.Split(','));
                        rls.Roles = rolesList;
                    }
                    
                    GenerateTokenRequest generateTokenRequestParameters;
                    generateTokenRequestParameters = new GenerateTokenRequest(accessLevel: TokenAccessLevel.Create, datasetId:this.AppConfig.PowerBI_DataSetId, identities: new List<EffectiveIdentity> { rls });                
                    
                    var tokenResponse = await client.Reports.GenerateTokenForCreateInGroupAsync(this.UserSession.CurrentUser.Organization.PowerBIWorkspaceId, generateTokenRequestParameters);
                    
                    // Generate Embed Configuration.
                    model.EmbedConfig.EmbedToken = tokenResponse;                    

                }

I would greatly appreciate it if someone could point me towards some sample server side code for the "create report" scenario or tell me what I could be doing wrong above?

[Elderin · Accepted solution]

For anyone that has run into this issue, I figured out that the problem is that EffectiveIdentities are not allowed when retrieving tokens for report creation.  This does however lead to the next issue where I'm using the effectiveidentity for RLS and not passing it effectively gives access to all data (across all of our customers) when creating reports.  I'll create a separate ticket for that.