Problems with RLS

[lburgess]

I'm having a frustrating issue with RLS.  I have a new workspace with a single report.  RLS is set up and working when I execute the report on the desktop.  When I initially publish the report and add users to the various roles, the report also works as designed.  However, if I come back to the report later (30 minutes or so), RLS is not working. 

I've tried removing the dataset, re-publishing the report, and assigning the roles again but with no success.  If I start fresh with a new workspace, the security works initially, but then reverts to the behavior described above.  If I publish the report to an existing workspace (for example, My Workspace), the security works fine. 

That leads me to believe there is something going on with the new workspaces.  Is anyone else experiencing this?  Any ideas regarding how to resolve this?

[collinq]

Hi @lburgess ,

When you state that the RLS is not working, do you mean that the settings are removed or that it is not working as expected?  Have you confirmed that when it is not working that the settings are still in place?

Also, RLS can only be defined on datasets created within Desktop, is that where this dataset was created?  Also, RLS does not work on Live Connections (only works with DirectQuery and Import).

Do you perhaps have something conflicting - like giving a user Admin access to the report/workspace in the Service which is then in conflict with the RLS?

[lburgess]

It is not working as expected.  Everyone has access to all of the data - as if there was no RLS at all.

The report was created in the desktop.  Data is sourced from SQL Server (as are all of the other reports that utilize RLS).  

No one has Admin access except me.  If I deploy the report to one of the "old" workspaces or to My Workspace, the security works perfectly.

[collinq]

Hey @lburgess ,

If everybody has access to everything and RLS is being ignored, but is still setup then my thinking is that this would be that this workspace has a share to folks that is "overriding" RLS" - you may have the "allow users to connect to underlying data" selected, or perhaps something other than "viewer" is the level of the users in the workspace.

[lburgess]

No share.  Everyone is a viewer. 

As I said in my original post, the security works correctly when I initially set it up.  If I come back a little later, the security is still there but every user has access to all of the data as if RLS didn't exist.

[collinq]

Hey @lburgess ,

It might be time to open a ticket with Microsoft then - perhaps they can help dig in and see the issue.  Please update us with the results though!