PowerBi to Redshift Authentication

[harrison_greene]

Hi Everyone,

We are currently migrating our AWS data warehouse, and are struggling to create a working connection from Power Bi to Redshift that meets the following requirements:

- OAuth2.0 connection from Power Bi to Redshift

- Redshift RLS is enforced for end users, as we have sensitive data we don't want certain end users being able to see

- DirectQuery mode for data 

We are able to get an ODBC connection string from our serverless namespace, and also able to connect via user/pass (although this is not fit for requirements), but when we publish the report, and view it as a test user on Power Bi Service, either the report breaks, and no visuals can be displayed, or alternatively the test user can see all the data/visuals in the report, that they shouldn't have access to.

We don't want to rely on Power Bi side row level security ideally, but it is a fallback last resort option.

Any help is greatly appreciated!

[v-lgarikapat]

Hi @harrison_greene ,

Thank you for reaching out to the Fabric Community Forum.

@cengizhanarslan , @rohit1991  Thanks for your prompt response.

@harrison_greene I wanted to follow up to check if you had a chance to review the information provided by @cengizhanarslan  and @rohit1991  . If you are still facing issues, please don’t hesitate to reach out  we’ll be more than happy to assist you.

Best Regards,

Lakshmi.

[harrison_greene · Accepted solution]

Hi All,

We've managed to resolve this issue without any of your help, here is a video that has a step by step guide on how to set it all up

https://www.youtube.com/watch?v=S3MQLvZ-NiI&t=295s

[v-lgarikapat]

@harrison_greene , That’s great to hear the issue is resolved! Thank you for sharing the step‑by‑step video it will be a valuable resource for others.

Thanks,

Lakshmi.

[cengizhanarslan]

Have you enabled SSO in connection settings? If not you may end up with a single credential that connects to the data source without considering who is looking to the report. If that credential has the permission it is quite normal to see whole data instead using proper RLS.

https://learn.microsoft.com/tr-tr/power-bi/connect-data/service-gateway-sso-test-configuration

[rohit1991]

Hii @harrison_greene 

Power BI Service does not support user passthrough authentication to Amazon Redshift. In DirectQuery, all queries run using a single dataset credential, so Redshift-native RLS cannot be enforced per end user this is why visuals either break or users see all data. OAuth 2.0 does not change this behavior. Today, the only supported and reliable option is to implement Row-Level Security in Power BI itself (or use pre-filtered Redshift views as a limited workaround).

[harrison_greene]

Are we saying that SSO from PowerBi service to Redshift is not possible as an authentication method? 

[cengizhanarslan]

SSO from Power BI Service to Amazon Redshift is supported only via Microsoft Entra ID (Azure AD) SSO, using the native Amazon Redshift connector + the SSO settings on the gateway/vnet gateway (for DirectQuery).

https://learn.microsoft.com/en-us/power-query/connectors/amazon-redshift

[harrison_greene]

Hi,

The article you linked is very vague, and has no documentation on what provider name should be.

Can you link examples of where this setup has worked, either through community questions or official documentation?

Thank you