Row Level Security - Shared Dataset Two Reports

[jdevries192]

Hi All,

I have a question regarding the "Test as role" feature of RLS. Does it take into consideration report sharing permissions for shared datasets?

Example:

I have "dataset1" and two reports that utilize the dataset, "report1", "report2". I have "user1" who is assigned an RLS role on dataset1 and has "report1" shared with them. But they do not have "report2" shared with them.

"Test as role" seems to show that user1 can access report1 AND report2. Even though report2 is not shared to them (only Direct Access sharing is used on my reports).

Is this expected behavior or am I missing something?

[lbendlin]

That is expected behavior.  Reports are not protected. Semantic models are, via RLS and OLS.  Hiding a report is purely cosmetic if you give users access to the semantic model.

[jdevries192]

Are you just talking about hiding a report in the Workspace App? I'm asking only about sharing reports directly. RLS does not give access to a report.

I have always understood it as:

1. RLS controls what data you can see (filters the model)

2. Report sharing controls if you can access the report**

**As long as they don't have a Workspace role or have access through the Workspace app

If user1 has an RLS role for 1 dataset but does not have access to the report, then in "Test as role" it says "This user does not have access to the dataset or report". See my example below.

RLS Role:

View in "Test as Role"

When I grant the user "Read" access to the Report, the role works.

Granting user read access:

No error and report displays:

Going back to my original question -

I don't understand why "Test as Role" behaves differently with one report versus two reports connected to the same dataset.

test2 report is not shared with the user. But the same error shown above does not show.

[lbendlin · Accepted solution]

I guess I am jaded because we always allow build access. As soon as you do that report "security" becomes obsolete.

Our reasoning is that our job is to help users get insights, not to prevent them from getting access.