Hello,
I do have some general questions on the inegration of Power BI embedded with a custom multi-tenant SPA web application with OData and WebAPI data providing endpoints.
This is our scenario:
- We have a multi-tenant SPA web application with an ODATA-Service Layer (+ some WebAPIs Endpoints).
- The application has a custom Authentication-Module with custom User-Database. (Authentication is currently handled via login and JWT-Token). We may also activate Basic-Authentication if necessary.
- User-Permissions on data are handled directly in the OData and Web-API Layer. So only user permitted data gets returned by the endpoints. We would like to use our application-internal permission system and not additionally implement something like Row-level security within Power BI.
- A user can be member of multiple tenants. So a tenant id is passed in the request header to the application to define current tenant scope.
Our goal:
- we would like to implement our reporting and dashboards on basis of Power BI embedded.
- due the fact, that permitted data may differ from one user to another user, we would like to pass the current report-requester context from our application to the data source request of Power BI embedded. So report requester context will be passed to the data providing endpoint and our data providing endoint will do permission checks. (App owns data?)
- I read that a common scenario for PowerBi embedded in a multi-tenant environment is splitting up a Power BI embedded Worksapce per Application Tenant. As said, we don't like the idea of building a Power BI Row-level security solution, but we would also like to reduce effort in maintaining multiple workspaces and so would want to just have a minumum of workspaces.
Questions:
- Can you use OData-DataSources as DirectQuery Datasource, so that Report-Data is resolved on Report-Request-Time?
- Is it possible to use the Standard OData Feed Connector with JWT-Tokens? I only managed getting a connection to our OData-Endpoint using "Web.Contents" in the Advanced Query Editor.
- Is it possible to pass the current report-requester from the SPA Application to Power Bi, so that the Data Source is requested using this report-requester User-Context?
- Is it possible to support a multi-tenant application with just one Power BI Workspace and pass the needed tenant info to the data providing odata backend (additonal request header)? Again we would prefer going with the standard Data connectors.
Thank you very much for your help!
