Forum Discussion
Windows Authentication user name in Power BI Service?
Hi SamTrexler,
1. That username is set up at configuration time and is the same for all users running a report or dashboard that connects to a data feed that needs the gateway, correct? That is, it is not dynamic or user-based, and can't/doesn't pass or respond to the user's login credentials - it only uses the credentials set up for the gateway?
Assume that you are using the enterprise gateway, when you create a data source under the gateway, the specified credential is sent to access data source. The credential can be the same as the user run the report and dashboard or not, as long as the credential has the permission to access the data source. If you publish the .pbix file to service, when you configure data source in gateway, server name and database name need to be the same as defined in .pbix file.
2. That may be okay, but we'll have to figure a way to handle different users' access. For example, we don't want the data feed to expose financial tables if the user shouldn't have access to them. So we may need to provide different data feeds for different groups of users, and find a way to limit which feeds each user can see and try to use based on their role. Ideally, they should have one login that gets them access to all the reports & dashboards allocated to them, and they can't get to a table in a data feed that they shouldn't be abe to see. (And, of course, it should work if they use Excel, Power BI Desktop or Power BI Service or Mobile to connect to the data source.)
In your scenario, I would suggest you configure Row-Level Security to restrict data access for given users. See: Row-level security (RLS) with Power BI (Preview).
Best Regards,
Qiuyun Yu
Hi SamTrexler,
When we connect to data source in Power BI Service, credential used to access data source can be configured both in personal gateway and enterprise gateway. For more information, please refer to links below:
If you have any question, please feel free to ask.
Best Regards,
Qiuyun Yu
v-qiuyu-msft, Thanks. That username is set up at configuration time and is the same for all users running a report or dashboard that connects to a data feed that needs the gateway, correct? That is, it is not dynamic or user-based, and can't/doesn't pass or respond to the user's login credentials - it only uses the credentials set up for the gateway?
That may be okay, but we'll have to figure a way to handle different users' access. For example, we don't want the data feed to expose financial tables if the user shouldn't have access to them. So we may need to provide different data feeds for different groups of users, and find a way to limit which feeds each user can see and try to use based on their role. Ideally, they should have one login that gets them access to all the reports & dashboards allocated to them, and they can't get to a table in a data feed that they shouldn't be abe to see. (And, of course, it should work if they use Excel, Power BI Desktop or Power BI Service or Mobile to connect to the data source.)
So in this question I'm exploring the features and limitations of Power BI Service, and would like confirmation of what the Power BI Service does (or can do) in this regard.
Thanks,
Sam
Hi SamTrexler,
1. That username is set up at configuration time and is the same for all users running a report or dashboard that connects to a data feed that needs the gateway, correct? That is, it is not dynamic or user-based, and can't/doesn't pass or respond to the user's login credentials - it only uses the credentials set up for the gateway?
Assume that you are using the enterprise gateway, when you create a data source under the gateway, the specified credential is sent to access data source. The credential can be the same as the user run the report and dashboard or not, as long as the credential has the permission to access the data source. If you publish the .pbix file to service, when you configure data source in gateway, server name and database name need to be the same as defined in .pbix file.
2. That may be okay, but we'll have to figure a way to handle different users' access. For example, we don't want the data feed to expose financial tables if the user shouldn't have access to them. So we may need to provide different data feeds for different groups of users, and find a way to limit which feeds each user can see and try to use based on their role. Ideally, they should have one login that gets them access to all the reports & dashboards allocated to them, and they can't get to a table in a data feed that they shouldn't be abe to see. (And, of course, it should work if they use Excel, Power BI Desktop or Power BI Service or Mobile to connect to the data source.)
In your scenario, I would suggest you configure Row-Level Security to restrict data access for given users. See: Row-level security (RLS) with Power BI (Preview).
Best Regards,
Qiuyun YuHi, v-qiuyu-msft. Thanks, that's what I needed to know.
And thanks for the link concerning RLS. Last I looked it was only available for Analysis Services, which we aren't using (yet). It looks great. We may not be able to use it with an OData feed since that doesn't suport DirectQuery, but maybe there's another connection we can use thatsatisfies our requirements.
And I definitely need to experiment with groups and roles, that looks like it applies very well to what we need to do.
Thanks for the help.
Sam
