cancel
Showing results for 
Search instead for 
Did you mean: 
Reply
e2patrick Visitor
Visitor

SSAS Cube Security not working - Always connect as Admin

Our customer wants to build PowerBI reports against an existing Multidimensional Cube. We mapped the PowerBi Users (onmicrosoft.com) to AD users in the Data Source settings (CustomData).

This works for Excel and Power BI Desktop but not for Power BI Service.

I checked the profiler: The connection is made with

<EffectiveUserName>Admin account specified in the DataSource</EffectiveUserName><CustomData>Mapped Domain User Name</CustomData>

 

The problem: Each Power BI User we have tried can see anything. We have set up a Dynamic Security Role with Filters implemented on Dimension Data->Allowed Member set.

 

It seems to me that the admin account in the EffectiveUserName-Tag overrides the CustomData-account. So every user connect to the cube as an Admin.

 

Is this a bug. Am I missing something?

2 REPLIES 2
Community Support Team
Community Support Team

Re: SSAS Cube Security not working - Always connect as Admin

HI @e2patrick,

 

According to your description, I think the issue may related to your custom data mapping. 

It seems like power bi can't correct mapping users on service side so it use default account which you configured in datasource setting.

 

I'd like to suggest you use UPN to mapping users and try again:

User Principal Name (UPN) Mapping in Power BI

 

Regards,

Xiaoxin Sheng

Community Support Team _ Xiaoxin Sheng
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.



For learning resources/Release notes, please visit: | |
Highlighted
inayatkhan Frequent Visitor
Frequent Visitor

Re: SSAS Cube Security not working - Always connect as Admin

I have similar issues.

 

I have set the EffectiveUserName to show in the PowerBI logs correctly, and the on premise Power BI Gateway is using ENT\SQL_Analysis account that is a member of the Server Administrators on Analysis Server. However the Flight Record log is showing that the Power BI reports from the Power BI service are accessing the SSAS Analysis services multidimensional cube using "ENT\SQL_Analysis". This is an issue as the dynamic role security using UserName() , MDX command is only finding "ENT\SQL_Analysis" and NOT the  actual user's AD account. Now their AD acccount would be Domain\Username. e.g EU\ELu   however their effective user name is for example. Elaine.Lu@Company.com

 

So the issues are 

1. Access to the cube by the Analysis server is always the Server admin account ( windows domain account) 

2. Effective User Name is NOT the same as AD Username so , MDX command Username() needs to return the AD account name and not effective user name.

3. Dynamic security is effectively being made ineffective due to points 1 and 2. Ask "Guy in a Cube" , Adam Saxton, how to get dynamic roles using AD accounts on SSAS cubes working with the apparent configuration and limitations of Power BI Gateway.

 

Regards

Inayat Khan

Helpful resources

Announcements
Back to School Contest

Back to School Contest

Engage and empower students with Power BI!

MBAS Gallery

Watch Sessions On Demand!

Continue your learning in our online communities.

Summit Australia 2019

Summit Australia 2019

Travel to Melbourne and network with thousands of peers!

PBI Community Highlights

PBI Community Highlights

Check out what's new in the Power BI Community!

Top Ideas
Users Online
Currently online: 269 members 2,287 guests
Please welcome our newest community members: