RLS And authorizations

[Cihan61]

Hello all,

we have the following problem in our company:

We don't want certain AD groups to have access to a dashboard. I have prepared and uploaded the authorization tables in the desktop version and then assigned the respective roles in the web versions.

The AD group in question was set to "Administator" yesterday. I then changed that to "View". The group is also shown as "View" in the accesses. But somehow the people in the AD group still get all the data displayed. I tried the same setting in the other workspaces and it works fine there. Therefore RLS should be set correctly.

In the other workspaces where it works, the so-called "readers" were already set as "view" from the beginning. Is it possible that the change was not made? Despite the fact that it says "View"?

thanks for your help

[Tutu_in_YYC]

Hey Cihan61,

is there a possibility that those readers that see all the data, are also in a different security group that has the role IN { "Member", "Contributor", "Viewer" } ? (pardon the dax pun)

i.e John is in ADGroup1 that is "Viewer", but he is also in ADGROUP2 that is "Admin" in the workspace

If yes, that other security group will bypass the RLS.

[Cihan61]

Hey Tutu_in_YYC,

we have two workspaces. Different viewer security groups have been created for both workspaces.

Workspace Crew > Crew_Readers
Workspace Operations > Ops_Readers

The person is in both view security groups. While it works in Workspace Operations, it does not work in Workspace Crew. But strange is also that some people Workspace Crew despite Crew_readers authorization, can not see the data (as it should be).

[Tutu_in_YYC]

Assuming when you tested in both workspaces, they are individual datasets ( i.e not shared dataset between workspace).

If it works in Workspace Operations, but doesnt in Workspace Crew. It could be the person e.g Adam, has been assigned with a different role in a different way.

Example
In Workspace Operations, you have these members:

1. Ops_Readers - Assigned as Viewer - contains Adam

2. Adam - Assigned as Member

3. SecurityGroup2 - Assigned as Member - contains Adam


(2) or (3) will bypass RLS, and Adam will see all data.

[Cihan61]

thanks 🙂 But ....

Workspace Operations we have followings Security Groups:

OPS_Readers (Viewer) > Contains Adam

OPS_PowerUsers (Admin) > Without Adam

Workspace Crew we have followings Security Groups:

Crew_Readers (Viewer) > Contains Adam

Crew_PowerUsers (Admin) > Without Adam

There are no other security groups. 

[Tutu_in_YYC]

Same report and dataset in both workspaces? As @otravers mentioned, what did you use for the RLS DAX syntax?

[Cihan61]

i have a file that i have saved locally and i load this file in two different workspaces. In that case we would have two different datasets in two different workspaces, right? But if I delete one of them in a workspace, the same thing happens.

The Dax formula is the following:

I am not sure if it is really due to the Dax formula. When I test it on the desktop version, it works fine. I enter the email address of the person and it works.

[Tutu_in_YYC]

Yeah the DAX looks fine. It has to be some overlap of roles. Just to confirm there are only 2 members in each workspace and they are the security groups, no other members in there?

---

@Cihan61 wrote:

Workspace Operations we have followings Security Groups:

OPS_Readers (Viewer) > Contains Adam

OPS_PowerUsers (Admin) > Without Adam

Workspace Crew we have followings Security Groups:

Crew_Readers (Viewer) > Contains Adam

Crew_PowerUsers (Admin) > Without Adam

---

If yes, this is a doozy...

[otravers]

In the workspace where RLS isn't applied as expected while viewing, does RLS at least work in the testing functionality accessible from the dataset's security settings?

[Cihan61]

Hi,
no, it does not work there. I always test it from there. Can it be that it does not work with the test but still works in reality?

[otravers]

I don't think that RLS can work in reality if it doesn't in the test area.

If things don't work in the test area, I think you can exclude workspace membership considerations (i.e. RLS is only applied to Viewers) and should focus on doublechecking two things:

1. Membership of users in AD groups, with possible overlaps

2. Syntax of RLS DAX expressions

It might be useful to create a spreadsheet of your users, their groups, and retest everything from the ground up.