Forum Discussion
Row Level Security for on prem analysis services stopped working
Hi
I've got a Tabular Analysis Services database which has RLS implemented based on 'username' of the person accessing the report. They're all salespeople and can see their sales only, or their direct reports.
My Power BI reports were, until a week ago, replicating the RLS but it's stopped working. Users who should now be restricted can see all sales data, not just theirs. The Tabular model still has the RLS implemented and it works fine if I access through Excel. I'm not getting any error messages on accessing the data - they can just see everything.
The only change I can think was adding additional users who haven't yet accessed the reports, and some of which are members of a different security group so aren't affected by the RLS.
Any ideas?
Cheers
Ben
5 Replies
Hi benmarriott, I would suggest that you run a SQL Profiler on your SSAS Tabular Instance and ensure that the effictive username is getting passed from the Power BI Service to your SSAS Tabular model.
You can refer to this blog post by the Power BI Team
https://powerbi.microsoft.com/en-us/documentation/powerbi-gateway-onprem-tshoot/
Or this community post which explains it in more detail.
Thanks GilbertQ
So I've run the Profile trace and it's showing my credentials when I access the Power BI service (web) by logging in as another user when running any queries.
Given that previously the security on the SSAS was working in Power BI something has changed and now it's passing my credentials rather than the user who's using the service. The only thing I can think is that I have added some additional users and mapped their credentials (our [email protected] email is XXX-DOM\XXX) but I don't really see how that would affect it...
I've tried updating the gateway to the latest version and it's not helped.
Any other ideas?
Cheers
Benbenmarriott I would recommend reading these blog posts.
https://powerbi.microsoft.com/en-us/documentation/powerbi-admin-power-bi-security/
https://powerbi.microsoft.com/en-us/documentation/powerbi-gateway-onprem-indepth/
I do recall reading somewhere about how to ensure that there is the mapping from the Power BI Service through to your On-Premise SSAS Tabular Model. I can remember that somewhere there is an option to actually do a manual mapping from a username through to a UPN in your organisation. I cannot just find the link right now.
I found it! And I think this is what you might need to do below.
