Forbidden error - while generating embed token with RLS and DirectQuery (SQL server)

[Anonymous]

* We are trying to generate embed token for a powerbi document which was RLS enabled and DirectQuery based (SQL server).

We are using this below API to generate embed token

POST - https://api.powerbi.com/v1.0/myorg/groups/<groupId>/reports/<reportId>/generatetoken

Payload

{
    "accessLevel": "View",
    "identities": [{
        "username": "<email>",
        "roles": ["Custom Role"],
        "datasets": ["<id>"]
    }]
}

Response:

1. If the powerbi report using import query with RLS, it provides embed token

2. If the powerbi report using DirectQuery with RLS, it throws 403 forbidden error.

Can you please help us to resolve?

[v-rzhou-msft]

Hi @Anonymous ,

I suggest you to try refer to this offical blog. There is an example about how to generate embed for direct query report.

For reference:

https://learn.microsoft.com/en-us/rest/api/power-bi/embed-token/generate-token#example-of-generating-an-embed-token-for-a-power-bi-report-with-a-dataset-which-is-connected-with-directquery-to-another-power-bi-dataset.-all-related-dataset-ids-must-be-specified-in-the-request-with-'xmlapermissions'-set-to-'readonly'.-identityblobs-for-all-sso-enabled-data-sources-must-be-provided-in-the-'datasourceidentities'-array

And you may refer to below blogs to learn more details about how to generate embed token.

For reference:

Generate an embed token

Embed a report with cloud-based RLS

Best Regards,
Rico Zhou

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[Anonymous]

Hi @v-rzhou-msft 

Where can i find the identityBlob? What is Microsoft.PowerBI.ServiceContracts.Api.V1.IdentityBlob?

can you help me how to get identityBlob? 

{
    "error": {
        "code": "BadRequest",
        "message": "Bad Request",
        "details": [
            {
                "message": "Error converting value \"eyJ__fQ.ey__NH0.kvW__FSjg\" to type 'Microsoft.PowerBI.ServiceContracts.Api.V1.IdentityBlob'. Path 'identities[0].identityBlob', line 30, position 1295.",
                "target": "request.identities[0].identityBlob"
            }
        ]
    }
}

[Anonymous]

Hi @v-rzhou-msft 

Can you please reply for my issue (my previous reply)?

[AmosHersch]

datasourceIdentities is only relevant when you have a data source with sso enabled. If you don't have such then you don't need to provide your data sources in the request. Just leave it empty

[Anonymous]

Hi @AmosHersch 

Tried the `identityBlob` as empty string, but i got below error again

{
    "error": {
        "code": "InvalidRequest",
        "message": "Datasource identity must contain identity blob"
    }
}

[AmosHersch]

You shouldnt send datasourceIdentities array at all

[Anonymous]

Hi @v-rzhou-msft 

Thank you for your reply. In my powerbi document, we are not using azure SQL, we are using our own instance of SQL server. 

var myHeaders = new Headers();
myHeaders.append("Content-Type", "application/json");

var raw = JSON.stringify({
  "datasets": [
    {
      "id": "123..",
      "xmlaPermissions": "ReadOnly"
    }
  ],
  "reports": [
    {
      "id": "235.."
    }
  ],
  "datasourceIdentities": [
    {
      "datasources": [
        {
          "datasourceType": "Sql",
          "connectionDetails": {
            "server": "...test.database.windows.net",
            "database": "testdb"
          },
          "datasourceId": "13d...c",
          "gatewayId": "ca1...4"
        }
      ]
    }
  ]
});

var requestOptions = {
  method: 'POST',
  headers: myHeaders,
  body: raw,
  redirect: 'follow'
};

fetch("https://api.powerbi.com/v1.0/myorg/GenerateToken", requestOptions)
  .then(response => response.text())
  .then(result => console.log(result))
  .catch(error => console.log('error', error));

I got below error 

{
    "error": {
        "code": "InvalidRequest",
        "message": "Datasource identity must contain identity blob"
    }
}

But in the powerbi document, the description of the indentityBlob is like below

`A blob for specifying an identity. Only supported for datasets with a DirectQuery connection to Azure SQL`

In my case i am not using AZURE sql. Can you please help us here?