Forum Discussion
Object level security for contributors - are separate data sets the solution?
Hi kajetanbocek,
Yes this setup will work:
- The important detail is that group C must not have Contributor/Member/Admin access to the workspace that contains the dataset i.e Workspace A, otherwise RLS/OLS will be bypassed.
- Keep the dataset in Workspace A and implement RLS and OLS in that model, grant group C Build permission on that dataset and put reports in Workspace B where group C are Contributors.
This way they can build reports while still being subject to the RLS/OLS defined in the model.
Thanks and regards,
Anjan Kumar Chippa
So, I received the answer that a setup like this should work:
- Workspace A contains a semantic datamodel (D)
- RLS on semantic datamodel (D) which results in user group (C) not seeing any rows in the tables that it should not have access to.
- Workspace B is linked to semantic datamodel (D) but contains only reports.
- User group (C) has contributor role in workspace B.
According to the answer I received, this should allow the users to build in workspace B with contributor rights but wihthout having access to tables with restricted access.
I have not tested this setup, so please inform me (and the rest of the internet) if this does not work.
Hi kajetanbocek,
Yes this setup will work:
- The important detail is that group C must not have Contributor/Member/Admin access to the workspace that contains the dataset i.e Workspace A, otherwise RLS/OLS will be bypassed.
- Keep the dataset in Workspace A and implement RLS and OLS in that model, grant group C Build permission on that dataset and put reports in Workspace B where group C are Contributors.
This way they can build reports while still being subject to the RLS/OLS defined in the model.
Thanks and regards,
Anjan Kumar Chippa