2

i've got an on premise SSAS instance which is configured in powerbi using gateway, configuration is proper as report using dataset from SSAS works from app.powebi and even from embedded report if token is requested using username/password flow.

From security reasons our client demand was to introduce service principal, it is turned on, set as admin on workspace, i've added 'ReadOverrideEffectiveIdentity' to service principle using powerbi dataset api.

Currently when i request embedd token using clientSecret (service principal) it requires EffectiveIdentity to be passed (which was not passed before in this path).

I've tested two different approaches:

-passed EffectiveIdentity with identifier = ServicePrincipalObjectId

-passed currently logged userId (this is normally passed for other datasets pointing directly to database):

  • report is embedded but when it's loadingvisuals i get 401 and i can see that 'https://wabi-north-europe- redirect.analysis.windows.net/explore/querydata' returned
    "{"error":{"code":"RLSNotAuthorizedForImpersonation","pbi.error":{"code":"RLSNotAuthorizedForImpersonation","parameters":{},"details":[],"exceptionCulprit":1}}}"

i've tried with different users, added manually to SSAS security pane with proper roles, Gateway is in newest possible version. In Gateway logs there is info about request, some processing but in scenario when it doesn't work there is no report sql execution.

Do you have any ideas what should i check next and what is wrong?

I've based my work mostly on:

https://prologika.com/power-bi-embedded-service-principals-and-ssas/

https://learn.microsoft.com/en-us/power-bi/developer/embedded/embedded-row-level-security#on-premises...

https://learn.microsoft.com/en-us/power-bi/developer/embedded/embedded-row-level-security#working-wit...

Thanks in advance

DaveCiki
  • 21
  • 1

1 Answers1

0

https://learn.microsoft.com/en-us/power-bi/developer/embedded/embedded-row-level-security#on-premises-data-gateway-with-service-principal

You need to add the service principal as an administrator on the data gateway that is being used for the connection to the onpremise SSAS dataset. You may need to add the Service Principal to an Azure AD group, make this group a gateway admin.

  1. PowerBI.COM
  2. Click the gear on top right corner
  3. Click Manage Gateways
  4. Click the gateway on the tree to the left that is used to connect to your onpremise SSAS db
  5. Click the Gateway
  6. Click and change from the Gateway Cluster Settings tab to the Administrators tab.
  7. Add the service principal as an administrator

Also are you sure you are genearting the embedded-token with the required identity? SSAS data sources will required an effective identity.

"identities": [
    {
      "username": "user@my-app.com",
      "roles": [
        "report-rls-role-name"
      ],
      "datasets": [
        "my-dataset-id-xxxxx-xxxxx-xxxxx"
      ]
    }
]
vvvv4d
  • 3,881
  • 1
  • 14
  • 18