Simultaneous Access to Embedded Power BI Report Across Multiple URLs Leads to Parameter Overwrite

[Anonymous]

Issue Summary: We are facing an issue where parameters are being overwritten in a Power BI report embedded across different domains when multiple users access the report simultaneously via different URLs. The parameter updates from one domain reflect in another, causing incorrect data to display in both sessions. This issue is occurring even when using Power BI REST APIs to manage parameters and report refresh.

Details:

1. Environment:

   • We are using the following URLs for embedding reports:
     • User 1: n20a.netzoom.com
     • User 2: 20.netzoom.com

2. Power BI REST APIs Involved:

   • Get Access Token: https://analysis.windows.net/powerbi/api/.default
   • Get Workspace List: https://api.powerbi.com/v1.0/myorg/groups
   • Get Report: https://api.powerbi.com/v1.0/myorg/groups/{workspaceId}/reports
   • Check Parameter Availability: https://api.powerbi.com/v1.0/myorg/groups/{workspaceId}/datasets/{datasetId}/parameters
   • Update Parameter: https://api.powerbi.com/v1.0/myorg/groups/{workspaceId}/datasets/{datasetId}/Default.UpdateParameter...
   • Generate Embed Token: https://api.powerbi.com/v1.0/myorg/groups/{workspaceId}/reports/{reportId}/GenerateToken
   • Refresh Dataset: https://api.powerbi.com/v1.0/myorg/groups/{workspaceId}/datasets/{datasetId}/refreshes
   • Check Refresh Status: https://api.powerbi.com/v1.0/myorg/groups/{workspaceId}/datasets/{datasetId}/refreshes

3. Expected Behavior:

   • Each user should access the Power BI report from their respective URL (n20a.netzoom.com or 20.netzoom.com), with parameters updated and retained based on their session.
   • The report should refresh and display data based on the updated parameters for that user, isolated from other user sessions.

4. Problematic Scenario:

   • User 1 accesses the report from n20a.netzoom.com, and the BaseURLPara & SessionIDPara parameters are updated via the Update Parameter API call. The refresh API is triggered, and the report displays the correct data for User 1.
   • Meanwhile, User 2 accesses the same report from 20.netzoom.com, updates the parameters, and triggers a refresh API call.
   • As a result, User 1's report (accessed via n20a.netzoom.com) now reflects the parameters updated for User 2 (20.netzoom.com), overwriting the original parameters set for User 1.

5. Steps to Reproduce:

   1. Use the Generate Embed Token API to embed the same Power BI report for two users via different URLs (n20a.netzoom.com and 20.netzoom.com).
   2. User 1 logs in via n20a.netzoom.com, and the Update Parameter API is called to update BaseURLPara & SessionIDPara specific to User 1.
   3. User 2 logs in via 20.netzoom.com, and a similar Update Parameter API call is made to update the parameters for User 2.
   4. Observe that the parameter values from User 2 overwrite those of User 1, causing the report accessed by User 1 to show User 2's data.

6. Impact:

   • The parameter updates seem to be shared across sessions, leading to cross-session data contamination. Each user's report should remain isolated with its own parameters and refreshed data.

7. Expected Solution:

   • Is there a way to ensure parameter isolation for each user's session when accessing embedded reports from different URLs? We need a method to ensure that the parameter updates and refresh API calls are confined to each specific session, avoiding parameter overwrites between users.

[Anonymous]

Hi @Anonymous ,

I think this is classified as a session independence issue and you can refer to the following suggestions.

1. Use unique parameter names for each user session. For example, append a session-specific identifier to the parameter name to avoid conflicts.

2. Ensure that API calls for updating parameters and refreshing datasets apply to specific user sessions. This may require adding session-specific headers or parameters to the API request.

Here is a simplified example

def update_parameters(workspace_id, dataset_id, parameters, session_id):
    url = f"https://api.powerbi.com/v1.0/myorg/groups/{workspace_id}/datasets/{dataset_id}/Default.UpdateParameters"
    headers = {
        "Content-Type": "application/json",
        "Authorization": f"Bearer {access_token}"
    }
    payload = {
        "updateDetails": [
            {
                "name": f"{param['name']}_{session_id}",
                "newValue": param['value']
            } for param in parameters
        ]
    }
    response = requests.post(url, headers=headers, json=payload)
    return response.json()

Best Regards,

Clara Gong

If there is any post helps, then please consider Accept it as the solution  to help the other members find it more quickly.

[Anonymous]

@Anonymous 

As per your Suggestion, I passed the baseurl and sessionid in the request body of update-parameter API for each baseurl it's sessionid is unique.

Scenario: When one request comes in and is still in progress, and another request arrives at the same time, the parameter gets updated. However, since the refresh takes a bit of time, the parameter from the first request gets replaced by the parameter from the second request. During the refresh of the first request, it picks up the parameter from the second request and updates it.

The issue occurs because, in the image below, only one parameter is stored at a time. If a new parameter arrives, it stores that parameter, and the refresh process for the old parameter remains pending, causing it to take the new parameter instead.

[Anonymous]

Thanks @Anonymous for looking into issue..
With a Premium Per User (PPU) license, it is possible to embed the report on a client’s website and allow multiple users to access it simultaneously.Is there anything missing in my methodology mention above or it is enough?

[Shashanka]

@Anonymous, were you able to find a solution/work around for this? I am of the same situation. I have a large dataset and would love to have it filtered at parameter level rather than RLS.

[Anonymous]

Issue Summary: We are facing an issue where parameters are being overwritten in a Power BI report embedded across different domains when multiple users access the report simultaneously via different URLs. The parameter updates from one domain reflect in another, causing incorrect data to display in both sessions. This issue is occurring even when using Power BI REST APIs to manage parameters and report refresh.

Details:

Environment:

We are using the following URLs for embedding reports:
User 1: n20a.netzoom.com
User 2: 20.netzoom.com

Power BI REST APIs Involved:

Get Access Token: https://analysis.windows.net/powerbi/api/.default
Get Workspace List: https://api.powerbi.com/v1.0/myorg/groups
Get Report: https://api.powerbi.com/v1.0/myorg/groups/{workspaceId}/reports
Check Parameter Availability: https://api.powerbi.com/v1.0/myorg/groups/{workspaceId}/datasets/{datasetId}/parameters
Update Parameter: https://api.powerbi.com/v1.0/myorg/groups/{workspaceId}/datasets/{datasetId}/Default.UpdateParameter...
Generate Embed Token: https://api.powerbi.com/v1.0/myorg/groups/{workspaceId}/reports/{reportId}/GenerateToken
Refresh Dataset: https://api.powerbi.com/v1.0/myorg/groups/{workspaceId}/datasets/{datasetId}/refreshes
Check Refresh Status: https://api.powerbi.com/v1.0/myorg/groups/{workspaceId}/datasets/{datasetId}/refreshes

Expected Behavior:

Each user should access the Power BI report from their respective URL (n20a.netzoom.com or 20.netzoom.com), with parameters updated and retained based on their session.
The report should refresh and display data based on the updated parameters for that user, isolated from other user sessions.

Problematic Scenario:

User 1 accesses the report from n20a.netzoom.com, and the BaseURLPara & SessionIDPara parameters are updated via the Update Parameter API call. The refresh API is triggered, and the report displays the correct data for User 1.
Meanwhile, User 2 accesses the same report from 20.netzoom.com, updates the parameters, and triggers a refresh API call.
As a result, User 1's report (accessed via n20a.netzoom.com) now reflects the parameters updated for User 2 (20.netzoom.com), overwriting the original parameters set for User 1.

Steps to Reproduce:

Use the Generate Embed Token API to embed the same Power BI report for two users via different URLs (n20a.netzoom.com and 20.netzoom.com).
User 1 logs in via n20a.netzoom.com, and the Update Parameter API is called to update BaseURLPara & SessionIDPara specific to User 1.
User 2 logs in via 20.netzoom.com, and a similar Update Parameter API call is made to update the parameters for User 2.
Observe that the parameter values from User 2 overwrite those of User 1, causing the report accessed by User 1 to show User 2's data.
Impact:

The parameter updates seem to be shared across sessions, leading to cross-session data contamination. Each user's report should remain isolated with its own parameters and refreshed data.

Bekow is M Query:

let

   body="{""sessionId"": """& SessionIDPara &""",

   ""isSearch"": false,

   ""keyword"": """",

   ""exploreType"": 2}",

   Source=Json.Document(Web.Contents(BaseURLPara,

[

RelativePath="/testAPI/explorer/location_hierarchy",

Content=Text.ToBinary(body),

               Headers=[#"Content-Type"="application/json"]

       ])),

   #"Converted to Table" = Record.ToTable(Source),

   Value = #"Converted to Table"{1}[Value],

   #"Converted to Table1" = Record.ToTable(Value),

   Value1 = #"Converted to Table1"{0}[Value],

   #"Parsed JSON" = Json.Document(Value1),

   #"Converted to Table2" = Record.ToTable(#"Parsed JSON"),

   #"Expanded Value" = Table.ExpandListColumn(#"Converted to Table2", "Value"),

   #"Expanded Value1" = Table.ExpandRecordColumn(#"Expanded Value", "Value", {"EntID", "EntityName", "Name", "Description", "Type", "Icon", "Room"}, {"EntID", "EntityName", "Name.1", "Description", "Type", "Icon", "Room"}),

   #"Expanded Room" = Table.ExpandListColumn(#"Expanded Value1", "Room"),

   #"Expanded Room1" = Table.ExpandRecordColumn(#"Expanded Room", "Room", {"EntID", "EntityName", "Name", "Description", "Type", "Icon", "Floor"}, {"EntID.1", "EntityName.1", "Name.2", "Description.1", "Type.1", "Icon.1", "Floor"}),

   #"Expanded Floor" = Table.ExpandListColumn(#"Expanded Room1", "Floor"),

   #"Expanded Floor1" = Table.ExpandRecordColumn(#"Expanded Floor", "Floor", {"EntID", "EntityName", "Name", "Description", "Type", "Icon", "HasChildren"}, {"EntID.2", "EntityName.2", "Name.3", "Description.2", "Type.2", "Icon.2", "HasChildren"}),

   #"Renamed Columns1" = Table.RenameColumns(#"Expanded Floor1",{{"EntID", "Parent ID"}, {"Name.1", "Site Name"}, {"Type", "Room Type"}, {"Name.2", "Room Name"}, {"Name.3", "Floor Name"}}),

   #"Removed Columns" = Table.RemoveColumns(#"Renamed Columns1",{"Description", "Icon", "Description.1", "Icon.1", "Description.2", "Icon.2"}),

   #"Filtered Rows" = Table.SelectRows(#"Removed Columns", each ([EntID.1] <> null) and ([EntID.2] <> null))

in

   #"Filtered Rows"

Expected Solution:

Is there a way to ensure parameter isolation for each user's session when accessing embedded reports from different URLs? We need a method to ensure that the parameter updates and refresh API calls are confined to each specific session, avoiding parameter overwrites between users.