Forum Discussion

Cihan61's avatar
Cihan61
Frequent Visitor
3 years ago

RLS And authorizations

Hello all,   we have the following problem in our company: We don't want certain AD groups to have access to a dashboard. I have prepared and uploaded the authorization tables in the desktop versi...
Need Help
Tutu_in_YYC's avatar
Tutu_in_YYC
Super User
3 years ago

Hey Cihan61,

is there a possibility that those readers that see all the data, are also in a different security group that has the role IN { "Member", "Contributor", "Viewer" } ? (pardon the dax pun)

i.e John is in ADGroup1 that is "Viewer", but he is also in ADGROUP2 that is "Admin" in the workspace

If yes, that other security group will bypass the RLS.

  • Cihan61's avatar
    Cihan61
    Frequent Visitor
    3 years ago

    Hey Tutu_in_YYC,

     

    we have two workspaces. Different viewer security groups have been created for both workspaces.

     

    Workspace Crew > Crew_Readers
    Workspace Operations > Ops_Readers

     

    The person is in both view security groups. While it works in Workspace Operations, it does not work in Workspace Crew. But strange is also that some people Workspace Crew despite Crew_readers authorization, can not see the data (as it should be).

    • Tutu_in_YYC's avatar
      Tutu_in_YYC
      Super User
      3 years ago

      Assuming when you tested in both workspaces, they are individual datasets ( i.e not shared dataset between workspace).

      If it works in Workspace Operations, but doesnt in Workspace Crew. It could be the person e.g Adam, has been assigned with a different role in a different way.

      Example
      In Workspace Operations, you have these members:

      1. Ops_Readers - Assigned as Viewer - contains Adam

      2. Adam - Assigned as Member

      3. SecurityGroup2 - Assigned as Member - contains Adam


      (2) or (3) will bypass RLS, and Adam will see all data.

      • Cihan61's avatar
        Cihan61
        Frequent Visitor
        3 years ago

        thanks 🙂 But ....

         

        Workspace Operations we have followings Security Groups:

        OPS_Readers (Viewer) > Contains Adam

        OPS_PowerUsers (Admin) > Without Adam

         

        Workspace Crew we have followings Security Groups:

        Crew_Readers (Viewer) > Contains Adam

        Crew_PowerUsers (Admin) > Without Adam

         

        There are no other security groups.