Share via

SSAS Tabular : User in two security roles with rows security filters and object-level security filters

Ricardo Castro 21 Reputation points
2020-10-29T19:34:03.617+00:00

Hi,

I am implementing a dynamic filter in roles that I have in my SSAS Tabular cube. I have a user that is in two different roles.

If I test my data using this user only in one role everything returns as expected, but if the user is in two different roles I get the following error.

The combination of active roles results in a dynamic security configuration that is currently not supported. Please contact the administrator of the database to resolve this issue. (Microsoft SQL Server 2017 Analysis Services)

I have rows security filters and object-level security filters.

This error appears to anyone? Anyone knows how to pass through this issue?

Thanks for all your help.

-- Ricardo Castro

SQL Server Analysis Services
SQL Server Analysis Services
A Microsoft online analytical data engine used in decision support and business analytics, providing the analytical data for business reports and client applications such as Power BI, Excel, Reporting Services reports, and other data visualization tools.
1,264 questions
0 comments
Accepted answer
  1. Darren Gosbell 2,376 Reputation points
    2020-11-05T11:09:01.66+00:00

    Sorry, I have to post this as another "answer" as apparently replies are limited to 1000 characters.

    I understand what you mean, but, in my understanding, the potential exposure is there using one role or two roles.

    No, it's not. The exposure is very different with multiple roles. The security filters within a single role are combined with a logical AND. Where as the security filters for multiple roles are always unioned together, effectively combined with a logical OR. This is not a problem if the roles are filtering the same table eg. Customer[Country] = "USA" and Customer[Country] = "France" - in that case you get the expected result. But it is very different if you have filters on different tables.

    For example if you have 2 filters on different tables like:

    1. Customer[Marital Status] = "M"
    2. Product[Color] = "Red"

    If these are specified in one role then you will only see data where Customer[Marital Status] = "M" AND Product[Color] = "Red"

    If these are specified in two roles you will see data where Customer[Marital Status] = "M" OR Product[Color] = "Red" so you will see other colors for married customers and you will see other marital statuses for red products.

    2 people found this answer helpful.

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Lukas Yu -MSFT 5,821 Reputation points
    2020-10-30T07:29:06.457+00:00

    Hi Ricardo,

    It seems currently RLS and OLS are not supported to be used in combination.

    You could vote one that product feedback, to asking for this feature in future.

    Combination of OLS and RLS in SSAS Tabular

    Regards,
    Lukas

    1 person found this answer helpful.