Forum Discussion

Cihan61's avatar
Cihan61
Frequent Visitor
3 years ago

RLS And authorizations

Hello all,

 

we have the following problem in our company:

We don't want certain AD groups to have access to a dashboard. I have prepared and uploaded the authorization tables in the desktop version and then assigned the respective roles in the web versions.

 

The AD group in question was set to "Administator" yesterday. I then changed that to "View". The group is also shown as "View" in the accesses. But somehow the people in the AD group still get all the data displayed. I tried the same setting in the other workspaces and it works fine there. Therefore RLS should be set correctly.

 

In the other workspaces where it works, the so-called "readers" were already set as "view" from the beginning. Is it possible that the change was not made? Despite the fact that it says "View"?

 

thanks for your help

Need Help

10 Replies

  • otravers's avatar
    otravers
    Community Champion
    3 years ago

    In the workspace where RLS isn't applied as expected while viewing, does RLS at least work in the testing functionality accessible from the dataset's security settings?

    • Cihan61's avatar
      Cihan61
      Frequent Visitor
      3 years ago

      Hi,
      no, it does not work there. I always test it from there. Can it be that it does not work with the test but still works in reality?

      • otravers's avatar
        otravers
        Community Champion
        3 years ago

        I don't think that RLS can work in reality if it doesn't in the test area.

         

        If things don't work in the test area, I think you can exclude workspace membership considerations (i.e. RLS is only applied to Viewers) and should focus on doublechecking two things:

         

        1. Membership of users in AD groups, with possible overlaps

        2. Syntax of RLS DAX expressions

         

        It might be useful to create a spreadsheet of your users, their groups, and retest everything from the ground up.

  • Tutu_in_YYC's avatar
    Tutu_in_YYC
    Super User
    3 years ago

    Hey Cihan61,

    is there a possibility that those readers that see all the data, are also in a different security group that has the role IN { "Member", "Contributor", "Viewer" } ? (pardon the dax pun)

    i.e John is in ADGroup1 that is "Viewer", but he is also in ADGROUP2 that is "Admin" in the workspace

    If yes, that other security group will bypass the RLS.

    • Cihan61's avatar
      Cihan61
      Frequent Visitor
      3 years ago

      Hey Tutu_in_YYC,

       

      we have two workspaces. Different viewer security groups have been created for both workspaces.

       

      Workspace Crew > Crew_Readers
      Workspace Operations > Ops_Readers

       

      The person is in both view security groups. While it works in Workspace Operations, it does not work in Workspace Crew. But strange is also that some people Workspace Crew despite Crew_readers authorization, can not see the data (as it should be).

      • Tutu_in_YYC's avatar
        Tutu_in_YYC
        Super User
        3 years ago

        Assuming when you tested in both workspaces, they are individual datasets ( i.e not shared dataset between workspace).

        If it works in Workspace Operations, but doesnt in Workspace Crew. It could be the person e.g Adam, has been assigned with a different role in a different way.

        Example
        In Workspace Operations, you have these members:

        1. Ops_Readers - Assigned as Viewer - contains Adam

        2. Adam - Assigned as Member

        3. SecurityGroup2 - Assigned as Member - contains Adam


        (2) or (3) will bypass RLS, and Adam will see all data.