Building .NET front end with PBI Embedded reports. .NET Users -> PBI Embedded?

[pauljacobevans]

Building a .NET web application that'll handle user authentication for clients, we'll be using PBI Embedded for charts and visuals.  Within Power BI there is fantastic user-level security controls and filtering.  Use case: Have all data for national sales numbers, but when my regional manager logs into my .NET app I want them to only see a sub section of filtered data they only have access to.

I know there's the API embedded layer, but how can you interface with an external authentication layer, or is it possible to wrap in Azure authenticaiton into our .NET app to make this connectivity work.

I really want to have the user subset security filters on the data, that's a huge requirement for this to work.

Thoughts?

[Dave1]

Hi, 

All depends on your auhentication architecture, data modeling, your extternal app capability. If you use the same domanname/username for the exteranl authentication and PowerBI, then just create a role and impliment dynamic row level security (DRLS). 

If your have different authentication processes, then  you have to create a two-step authentication process. First, You need to add  your users external authentication layer information (login neme(User Name)) as one field - say you have a user security table called, dimUserSecurity. This table has UserID, UserExternalLoginName, UserADName, FirstName, LastName etc... allow this table to have bidirectional relationship in your model.  When a user login to your aplication, you can add their loginName(UserName) as fliter toPowerBi in your API call. So, your reports/dashboards will be flittered for each user based on their role/permission. The user ONLY see what he has access to.

[pauljacobevans]

Awesome info.  Thank you.

We're re-building the front end .NET app from the ground up, 99% of the app workload is PowerBI.  So simplicity in this authentication hand-off is ideal for us.

Here's what I'm trying to understand (an example):

1.) I log into our application, a .NET web app using built-in .NET authentication:  https://portal.pjskillerpizza.com

2.) I can name my logon accounts whatever I want, so lets use something Azure (and PowerBI) understand: pjevans@pjskillerpizza.com.

3.) So I've just logged into my .NET app as pjevans@pjskillerpizza.com, cool.

4.) Now I go to the sales page, this has a PowerBI embedded report on it.  On the back-end within PowerBI I've set data security roles for (pjevans@pjskillerpizza.com) to only see regional sales for my region.

5?.) How does my app communicate the .NET web app logged on user with the PowerBI backend when the report is pulled?

That's what I'm still unclear about...



Thanks again for the help, this community is amazing. 🙂

[Dave1]

Hi, 

Here is a highlevel solution. I assume that you know how to create Dynamic Row Level Security, BowerBI Embeding using the Master User account. 

Step 1: In your data model, add a security table called - eg. dimSecurity with the following fields: 

                      UserID, SalesRegionID, UserPrincipalName, UserName ---etc 

Step 2: Make sure that you have mapped your application logon names - add the logon name of your users in UserPrincipalName field. This helps you to map your users to their respective sales regions. If

Step 3: In you data model, add a control table - e.g. called dimSalesRegion with the following fields:

                    SalesRegionID, UserID, SalesRegionName ---etc 

Step 4 : In your data model, create a bidirectional relationship between dimSecurity and dimSalesRegion using SalesRegionID

Step 5: Create a bidirectional relationship between dimSalesRegion and your central tables - may be fact table using SalesRegionID

Step 6: In your model, create a role - eg. called ExternalUser --  use something similar dax function

                      UserPrincipalName = UserPrincipalName()

 UserPrincipalName function return the current user's principal name. 

Step 7: In your .net app Rest API call -  pass the principal user value as part of the API Call. Which means, your current user(principal) can only see data that are related to his princiapl user name (Sales Region). 

If you have detail technical questions: you can reach me at dawit@dabis.solutions.  Or you can review the offical PowerBI documents. 

[Eric_Zhang]

---

@pauljacobevans wrote:

Awesome info.  Thank you.

We're re-building the front end .NET app from the ground up, 99% of the app workload is PowerBI.  So simplicity in this authentication hand-off is ideal for us.

Here's what I'm trying to understand (an example):

1.) I log into our application, a .NET web app using built-in .NET authentication:  https://portal.pjskillerpizza.com

2.) I can name my logon accounts whatever I want, so lets use something Azure (and PowerBI) understand: pjevans@pjskillerpizza.com.

3.) So I've just logged into my .NET app as pjevans@pjskillerpizza.com, cool.

4.) Now I go to the sales page, this has a PowerBI embedded report on it.  On the back-end within PowerBI I've set data security roles for (pjevans@pjskillerpizza.com) to only see regional sales for my region.

5?.) How does my app communicate the .NET web app logged on user with the PowerBI backend when the report is pulled?

That's what I'm still unclear about...
Thanks again for the help, this community is amazing. 🙂

---

@pauljacobevans

I think Embedding for your customers is typcial for your case. In this scenario, it uses a master account to access Power BI Service. The roles set in Power BI Service doesn't affect this case. You just specify the username and roles when generating the embedded token. See Use row-level security with Power BI embedded content.

The correlated PBI REST API is GenerateToken.