Row Level Security to customized authentication

[fedebona]

I have an instance of PBIRS on premises (May 2020). I implemented my own authentication and authorization libraries implementing  IAuthenticationExtension and IAuthorizationExtension.

I created a principal name called "everyone" allowing permissions to all users in the CheckAccess methods.

When I go to a report with RLS anyways it doesn't work and I get the following log

Exception of type 'Microsoft.PowerBI.ReportServer.WebApi.ASConnection.RlsNotAuthorizedForModelException' was thrown

Do I have to do something more? Is permission check for RLS different from the other ones?

[gboreki · Accepted solution]

Yes, checks for RLS are different since those are not server permissions. We don't have in our custom authentication interfaces the ability to determine if a user is part of a group, so group roles are unsupported with custom auth. Feel free to post this int he ideas forum to help the team prioritize the ask: https://ideas.powerbi.com/

Thanks

-Boreki

[Arklur]

@gboreki 

Even though this is about custom auth, it seems that even with Basic it's not working. When we add a group to a role, a new login window popup comes up when someone in that group opens the report and it doesn't accept the 100% sure valid credentials (user/pwd). Works fine if we add specifically the user himself and not through the group. So can we say currently it's not possible to put groups into RLS roles, only users? If this is not supported, why is this even possible?

Why the docs says that you should be able to do this? https://docs.microsoft.com/en-us/power-bi/report-server/row-level-security-report-server

"Enter the user or group in the text box in the Username format (DOMAIN\user) and select the roles you wish to assign to them. The member has to be within your organization."

Are you sure it's working at all? If yes, any recommendations what could be the problem? What should we look for?

[gboreki]

Groups are supported for windows authentication. If you are seeing issues with that you should contact support so it can be investigated.