Row-level security
On OpenBI Server, a model’s roles decide which rows a workspace’s Viewers see, in the browser and in Excel. The roles, and who is in them, are made in OpenBI Studio and published with the model.
Who sees what
| Who | Sees |
|---|---|
| The workspace’s Admins, Members and Contributors, and the server’s administrators | All of the model’s data, as the people who publish it. |
| The workspace’s Viewers | The rows the model’s roles they are in let them see. With several roles, what any of them lets them see. |
- A model without roles shows its Viewers everything.
- A model with roles shows a Viewer who is in none of them nothing, and says why.
- Tables and columns hidden from a role don’t exist for its members: not in reports, not in Excel.
- Viewers get no formulas: the model comes to them without its OAX, in the browser and in Excel, unless the workspace’s Admins let them see formulas (see Can see formulas). Its measures still answer, on the server.
Before any of this, a person must have access to the workspace: someone not in it gets nothing at all (see Workspaces and roles).
Roles come from the model
The roles are part of the model, made in OpenBI Studio’s Security view: each role’s row filters in OAX, and the tables and columns hidden from it (see Roles). The server applies them as they are. OAX is compatible with DAX, so row filters written for Power BI or Analysis Services work here unchanged. A filter for each person uses USERPRINCIPALNAME(), which on the server is the person’s e-mail, as they signed in:
'Sales people'[E-mail] = USERPRINCIPALNAME()Who is in a role
Who has which role is set in OpenBI Studio too, and published with each version of the model:
- People, by their e-mail addresses;
- groups of the project, with their own members and other groups;
- e-mail domains: everyone signing in with an address of the domain, such as
norwayanalytics.no, is in the group.
The server matches them with the e-mail address the person signs in with, at OpenBI Accounts or at your own sign-in provider. To change who is in a role, change it in OpenBI Studio and publish the model again: the new version brings its members. An older version, opened read only, keeps the roles and members it was published with.
Workspace access and model roles are separate: adding someone to a role gives them no access to the workspace, and giving them access as a Viewer puts them in no role.
In the portal, an item’s What’s inside lists the model’s roles under Security roles: their names for everyone in the workspace, and for its Admins each role’s filters, its hidden tables and columns, and its members (see The portal).
Test a role
Test roles in OpenBI Studio before you publish: See as shows the model, the report pages, OAX queries and Excel as a role or a person sees them (see See as a role or a user). The server has no “view as” of its own. To check a published model, sign in as a test account that is a Viewer of the workspace.
In Excel
Analyze in Excel gives a Viewer the same rows, columns and measures as their reports: their roles apply to every PivotTable, and the measures come without their OAX. Excel signs in as the person, with their Excel password, and the server never lets a Viewer’s connection name another role or user. See Excel connections.
Live models
A live model, on Analysis Services or the Power BI service, keeps its data and its security on its own server. Its Contributors, Members and Admins see what the server’s connection sees. What its Viewers see is the model’s setting, under Live connection in its settings, What the workspace’s Viewers see:
- Viewers don’t open it (the default)
- They are told why, and to ask an Admin.
- Each Viewer as themselves
- The server asks as the person (Analysis Services’
EffectiveUserName, with their e-mail): the live server’s own roles decide what they see. The connection’s account must be allowed to act as others: an Analysis Services administrator, or in Power BI, a model’s writer. - Everyone in this workspace sees everything this connection sees
- A workspace Admin’s decision, asked to confirm, and in the audit log.
On the server itself, the same setting:
OpenBI.Server.exe live --workspace "<name>" --item "<item>" --viewers as-viewer--viewers takes off, as-viewer or everyone; without it, the command says what the setting is.
Frequently asked questions
Why does our administrator see rows a role hides?
Roles restrict Viewers only. The workspace’s Contributors, Members and Admins, and the server’s administrators, see all the data. To see a model as its Viewers do, test it in OpenBI Studio with See as, or sign in as a test Viewer.
A Viewer sees an empty report. Why?
The model has roles, and they are in none of them: the report says so. Add their e-mail, one of their groups or their e-mail domain to a role in OpenBI Studio, and publish again.
Does row-level security apply to lakes?
A lake has no row-level security of its own, so a Viewer reads no lake directly: they see a lake’s data only through the models that read it, as those models’ roles show it. See Who may use a lake.