Row-level security examples by BI tool

How row-level security works in EmbedPortal

Row-level security (RLS) is defined in your BI tool. EmbedPortal decides who the viewer is and which values apply, then passes those values when the dashboard loads.

1. In EmbedPortal, open Groups, pick a group and open the RLS tab.
2. Add up to 20 keys, such as customer_id or region. Each key takes a static value or a user attribute such as email or department.
3. On each dashboard that needs filtering, turn on Use RLS attribute.
4. Impersonate a user in the group to check the numbers.

Power BI

Create a role in the semantic model that filters on the viewer’s identity. EmbedPortal passes the identity and role in the embed token.

[CustomerEmail] = USERPRINCIPALNAME()

For a mapping table, filter the table that links users to customers, and let relationships filter the rest of the model. Test roles with View as in Power BI Desktop before publishing.

Tableau

With Connected Apps, EmbedPortal can send RLS values as user attributes in the token. Read them in a calculated field and use it as a data source filter.

[Customer ID] = USERATTRIBUTE('customer_id')

User attribute functions require Tableau Cloud or a recent version of Tableau Server with Connected Apps. You can also use user filters or data policies based on the viewer’s user name.

Amazon QuickSight

Add tag-based row-level security to the dataset, mapping a tag key such as customer_id to a column. EmbedPortal passes the value as a session tag when it generates the embed URL.

"SessionTags": [{ "Key": "customer_id", "Value": "acme" }]

Looker

Add an access filter in LookML that reads a user attribute. EmbedPortal sends the value as a user attribute in the signed embed request.

explore: orders {
  access_filter: {
    field: orders.customer_id
    user_attribute: customer_id
  }
}

Metabase

With signed static embedding, lock the filter parameter on the dashboard. EmbedPortal signs the value into the embed token so the viewer cannot change it.

params: { "customer_id": "acme" }

Domo

Use programmatic filters when the embed token is created. EmbedPortal adds the viewer’s values as filters on the matching column.

filters: [{ "column": "customer_id", "operator": "IN", "values": ["acme"] }]

Common mistakes

• The key name in EmbedPortal does not match the name used in the BI tool.
• Use RLS attribute is not turned on for the dashboard.
• A visual uses a table that is not filtered by the RLS table.
• Admins test while signed in as themselves instead of impersonating a viewer.