Row Level Security Data Discrepancy in Service

[Anonymous]

I created a dataset with row level security based on the users email. I then created a role to simulate a specific user to test the data against the filter and the data is as expected on the desktop. However, when I publish that dataset to the service, more data is available to that user than what is available on desktop. 

The dataset and report made from the dataset are in different workspaces. The user has viewer with build access to the workspace containing the dataset. The user has contributor access to the workspace where the report is in. 

Users are given access to workspaces using active directory groups and those active directory groups as assigned to the security filter in the service. This user is in two active directory groups that have viewer access to the same workspace. Could that be causing the issue or is there something else I can check?

[GilbertQ · Accepted solution]

Hi there

A user who has got any role higher than viewer will be able to see all the data.

As with your example the user in question has got the Contributor role and this is why they can see all the data.

[Anonymous]

They have viewer access to the dataset, if a report that is linked to this dataset is in a workspace where they are contributor then it bypasses the security filter? When he saved a copy of the report to his My Workspace it also showed more data. Does saving a report in my workspace bypass the security filter as well?

[GilbertQ]

Hi @Anonymous 

If the user has got contributor role on the report level and build access that would then give them access to the entire dataset. 

Ideally the user should only have read/view access to the dataset for it to work.