cancel
Showing results for 
Search instead for 
Did you mean: 
Reply
fedebona
Regular Visitor

Row Level Security to customized authentication

I have an instance of PBIRS on premises (May 2020). I implemented my own authentication and authorization libraries implementing  IAuthenticationExtension and IAuthorizationExtension.

I created a principal name called "everyone" allowing permissions to all users in the CheckAccess methods.

When I go to a report with RLS anyways it doesn't work and I get the following log

 

Exception of type 'Microsoft.PowerBI.ReportServer.WebApi.ASConnection.RlsNotAuthorizedForModelException' was thrown

 

Do I have to do something more? Is permission check for RLS different from the other ones?

1 ACCEPTED SOLUTION
gboreki
Microsoft
Microsoft

Yes, checks for RLS are different since those are not server permissions. We don't have in our custom authentication interfaces the ability to determine if a user is part of a group, so group roles are unsupported with custom auth. Feel free to post this int he ideas forum to help the team prioritize the ask: https://ideas.powerbi.com/

 

Thanks

-Boreki

View solution in original post

3 REPLIES 3
gboreki
Microsoft
Microsoft

Yes, checks for RLS are different since those are not server permissions. We don't have in our custom authentication interfaces the ability to determine if a user is part of a group, so group roles are unsupported with custom auth. Feel free to post this int he ideas forum to help the team prioritize the ask: https://ideas.powerbi.com/

 

Thanks

-Boreki

View solution in original post

@gboreki 

 

Even though this is about custom auth, it seems that even with Basic it's not working. When we add a group to a role, a new login window popup comes up when someone in that group opens the report and it doesn't accept the 100% sure valid credentials (user/pwd). Works fine if we add specifically the user himself and not through the group. So can we say currently it's not possible to put groups into RLS roles, only users? If this is not supported, why is this even possible?

 

Why the docs says that you should be able to do this? https://docs.microsoft.com/en-us/power-bi/report-server/row-level-security-report-server

 

"Enter the user or group in the text box in the Username format (DOMAIN\user) and select the roles you wish to assign to them. The member has to be within your organization."

 

Are you sure it's working at all? If yes, any recommendations what could be the problem? What should we look for?

Groups are supported for windows authentication. If you are seeing issues with that you should contact support so it can be investigated.

Helpful resources

Announcements
UG GA Amplification 768x460.png

Launching new user group features

Learn how to create your own user groups today!

Power BI October Update 2021.jpg

Power BI Release

Click here to read more about the October 2021 Release!

Community Connections 768x460.jpg

Community & How To Videos

Check out the new Power Platform Community Connections gallery!

Teds Dev Camp Oct. 2021 768x460.jpg

Power BI Dev Camp - October 28th, 2021

Mark your calendars and join us for our next Power BI Dev Camp!