Power BI 虚拟关系RLS禁用的权限控制

需求场景

构建权限时，所需构建角色的维度表，与其他明细表的关系是虚拟关系。

Power BI在使用userelationship或Crossfilter函数时，会与RLS冲突。

那么，如何在这种冲突的场景下，继续构建权限呢？

方案思路

本文方案基于dax公式：

1. 计算组（需下载tabular editor）

2. 函数过滤

3. 权限配置表（如需计划刷新，配置表路径需处于sql或sharepoint/onedrive）

---

另外，也可以将虚拟关系的两个列 作为两个表分开，以此避开虚拟关系，就不用这个方法了。

---

案例实现

1. 前提信息

region/branch 区分 领导 region/branch， 执行 region/branch

因此构建模型如下：维度表分别与明细表关联，使用虚拟关系动态激。

image.png

2. 权限表准备

权限将基于以下信息构建。

1）根据role key，区分是什么类型的role

2）根据员工id，确认拥有的权限行

3）分别筛选region branch 客户ID等信息

3. 实现

1）打开tabular editor

2. 创建计算组

Model > New calculation group
创建计算组后，右键计算组，创建新的item（领导region、执行region）

其中dax如下

领导：（激活region维度表与领导分公司相关的列的关联，[@testofremove]measure不受该计算组影响）

VAR accesslist =
    CALCULATETABLE (
        SUMMARIZE ( Access, Access[Role Key], Access[区域], Access[分公司], Access[客户ID] ),
        FILTER ( Access, Access[EmployeeID] = USERNAME () )
    )
VAR accesslist_region =
    CALCULATETABLE (
        VALUES ( Access[区域] ),
        FILTER ( Access, Access[EmployeeID] = USERNAME () )
    )
VAR accesslist_branch =
    CALCULATETABLE (
        VALUES ( Access[分公司] ),
        FILTER ( Access, Access[EmployeeID] = USERNAME () )
    )
VAR accesslist_customerid =
    CALCULATETABLE (
        VALUES ( Access[客户ID] ),
        FILTER ( Access, Access[EmployeeID] = USERNAME () )
    ) 

    //---------All，1
VAR if_all =
    CONTAINS ( accesslist, Access[Role Key], 1 ) 

    //---------RGM,2,Lead region = 权限表region
VAR if_rgm =
    CONTAINS ( accesslist, Access[Role Key], 2 )
VAR if_rgm_value =
    CALCULATE (
        IF (
            NOT ISSELECTEDMEASURE (
                [@testofremoveLead],
            ),
            CALCULATE (
                SELECTEDMEASURE (),
                USERELATIONSHIP ( Dim_RegionBranch[Connect], tableB[LeadRB] ),
                USERELATIONSHIP ( Dim_RegionBranch[Connect], tableA[LeadRB] ),
                USERELATIONSHIP ( Dim_RegionBranch[Connect], Target[LeadRB] ),
                USERELATIONSHIP ( Dim_RegionBranch[Connect], Customer[LeadRB] ),
                NOT ( ISBLANK ( tableB[LeadRB] ) ),
                NOT ( ISBLANK ( Target[LeadRB] ) ),
                --Not(isblank( Customer[LeadRB])),
                NOT ( ISBLANK ( tableA[LeadRB] ) )
            ),
            SELECTEDMEASURE ()
        ),
        Dim_RegionBranch[Region] IN accesslist_region
    ) 

//---------Regional KA manager,3,customerid = 权限表customer；
VAR if_rgm_ka =
    CONTAINS ( accesslist, Access[Role Key], 3 )
VAR if_rgm_ka_value =
    CALCULATE (
        IF (
            NOT ISSELECTEDMEASURE (
                [@testofremoveLead],               
            ),
            CALCULATE (
                SELECTEDMEASURE (),
                USERELATIONSHIP ( Dim_RegionBranch[Connect], tableB[LeadRB] ),
                USERELATIONSHIP ( Dim_RegionBranch[Connect], tableA[LeadRB] ),
                USERELATIONSHIP ( Dim_RegionBranch[Connect], Target[LeadRB] ),
                USERELATIONSHIP ( Dim_RegionBranch[Connect], Customer[LeadRB] ),
                NOT ( ISBLANK ( tableB[LeadRB] ) ),
                NOT ( ISBLANK ( Target[LeadRB] ) ),
                --Not(isblank( Customer[LeadRB])),
                NOT ( ISBLANK ( tableA[LeadRB] ) )
            ),
            SELECTEDMEASURE ()
        ),
        Customer[CustomerID] IN accesslist_customerid
    ) 

//---------BGM,4,Lead region = 权限表region && Lead branch = 权限表branch
VAR if_bgm =
    CONTAINS ( accesslist, Access[Role Key], 4 )
VAR if_bgm_value =
    CALCULATE (
        IF (
            NOT ISSELECTEDMEASURE (
                [@testofremoveLead],
            ),
            CALCULATE (
                SELECTEDMEASURE (),
                USERELATIONSHIP ( Dim_RegionBranch[Connect], tableB[LeadRB] ),
                USERELATIONSHIP ( Dim_RegionBranch[Connect], tableA[LeadRB] ),
                USERELATIONSHIP ( Dim_RegionBranch[Connect], Target[LeadRB] ),
                USERELATIONSHIP ( Dim_RegionBranch[Connect], Customer[LeadRB] ),
                NOT ( ISBLANK ( tableB[LeadRB] ) ),
                NOT ( ISBLANK ( Target[LeadRB] ) ),
                --Not(isblank( Customer[LeadRB])),
                NOT ( ISBLANK ( tableA[LeadRB] ) )
            ),
            SELECTEDMEASURE ()
        ),
        Dim_RegionBranch[Region]
            IN accesslist_region
            && Dim_RegionBranch[Branch] IN accesslist_branch
    ) 

//---------销售负责人,5,customerid = 权限表customer
VAR if_salesman =
    CONTAINS ( accesslist, Access[Role Key], 5 )
VAR if_salesman_value = if_rgm_ka_value
RETURN
    SWITCH (
        TRUE (),
        if_all,
            IF (
                NOT ISSELECTEDMEASURE (
                    [@testofremoveLead],
                ),
                CALCULATE (
                    SELECTEDMEASURE (),
                    USERELATIONSHIP ( Dim_RegionBranch[Connect], tableB[LeadRB] ),
                    USERELATIONSHIP ( Dim_RegionBranch[Connect], tableA[LeadRB] ),
                    USERELATIONSHIP ( Dim_RegionBranch[Connect], Target[LeadRB] ),
                    USERELATIONSHIP ( Dim_RegionBranch[Connect], Customer[LeadRB] ),
                    NOT ( ISBLANK ( tableB[LeadRB] ) ),
                    NOT ( ISBLANK ( Target[LeadRB] ) ),
                    --Not(isblank( Customer[LeadRB])),
                    NOT ( ISBLANK ( tableA[LeadRB] ) )
                ),
                SELECTEDMEASURE ()
            ),
        if_rgm, if_rgm_value,
        if_rgm_ka, if_rgm_ka_value,
        if_bgm, if_bgm_value,
        if_salesman, if_salesman_value
    )

**Exec：（激活region维度表与Exec列的关联）**

**//思路：获取当前username的list；根据role的不同类型 返回不同的列** VAR accesslist =
    CALCULATETABLE (
        SUMMARIZE ( Access, Access[Role Key], Access[区域], Access[分公司], Access[客户ID] ),
        FILTER ( Access, Access[EmployeeID] = USERNAME () )
    )
VAR accesslist_region =
    CALCULATETABLE (
        VALUES ( Access[区域] ),
        FILTER ( Access, Access[EmployeeID] = USERNAME () )
    )
VAR accesslist_branch =
    CALCULATETABLE (
        VALUES ( Access[分公司] ),
        FILTER ( Access, Access[EmployeeID] = USERNAME () )
    )
VAR accesslist_customerid =
    CALCULATETABLE (
        VALUES ( Access[客户ID] ),
        FILTER ( Access, Access[EmployeeID] = USERNAME () )
    ) 

    //---------All，1  
VAR if_all =
    CONTAINS ( accesslist, Access[Role Key], 1 ) 

    //---------RGM,2,Lead region = 权限表region
VAR if_rgm =
    CONTAINS ( accesslist, Access[Role Key], 2 )
VAR if_rgm_value =
    CALCULATE (
        CALCULATE (
            SELECTEDMEASURE (),
            USERELATIONSHIP ( Dim_RegionBranch[Connect], tableB[ExecRB] ),
            USERELATIONSHIP ( Dim_RegionBranch[Connect], tableA[ExecRB] ),
            USERELATIONSHIP ( Dim_RegionBranch[Connect], Target[ExecRB] ),
            USERELATIONSHIP ( Dim_RegionBranch[Connect], Customer[ExecRB] ),
            NOT ( ISBLANK ( tableB[ExecRB] ) ),
            NOT ( ISBLANK ( Target[ExecRB] ) ),
            --not(isblank( Customer[ExecRB])),  
            NOT ( ISBLANK ( tableA[ExecRB] ) )
        ),
        Dim_RegionBranch[Region] IN accesslist_region
    ) 

    //---------Regional KA manager,3,customerid = 权限表customer；
VAR if_rgm_ka =
    CONTAINS ( accesslist, Access[Role Key], 3 )
VAR if_rgm_ka_value =
    CALCULATE (
        CALCULATE (
            SELECTEDMEASURE (),
            USERELATIONSHIP ( Dim_RegionBranch[Connect], tableB[ExecRB] ),
            USERELATIONSHIP ( Dim_RegionBranch[Connect], tableA[ExecRB] ),
            USERELATIONSHIP ( Dim_RegionBranch[Connect], Target[ExecRB] ),
            USERELATIONSHIP ( Dim_RegionBranch[Connect], Customer[ExecRB] ),
            NOT ( ISBLANK ( tableB[ExecRB] ) ),
            NOT ( ISBLANK ( Target[ExecRB] ) ),
            --not(isblank( Customer[ExecRB])),  
            NOT ( ISBLANK ( tableA[ExecRB] ) )
        ),
        Customer[CustomerID] IN accesslist_customerid
    ) 

    //---------BGM,4,Lead region = 权限表region && Lead branch = 权限表branch
VAR if_bgm =
    CONTAINS ( accesslist, Access[Role Key], 4 )
VAR if_bgm_value =
    CALCULATE (
        CALCULATE (
            SELECTEDMEASURE (),
            USERELATIONSHIP ( Dim_RegionBranch[Connect], tableB[ExecRB] ),
            USERELATIONSHIP ( Dim_RegionBranch[Connect], tableA[ExecRB] ),
            USERELATIONSHIP ( Dim_RegionBranch[Connect], Target[ExecRB] ),
            USERELATIONSHIP ( Dim_RegionBranch[Connect], Customer[ExecRB] ),
            NOT ( ISBLANK ( tableB[ExecRB] ) ),
            NOT ( ISBLANK ( Target[ExecRB] ) ),
            --not(isblank( Customer[ExecRB])),  
            NOT ( ISBLANK ( tableA[ExecRB] ) )
        ),
        Dim_RegionBranch[Region]
            IN accesslist_region
            && Dim_RegionBranch[Branch] IN accesslist_branch
    ) 

    //---------销售负责人,5,customerid = 权限表customer
VAR if_salesman =
    CONTAINS ( accesslist, Access[Role Key], 5 )
VAR if_salesman_value = if_rgm_ka_value
RETURN
    SWITCH (
        TRUE (),
        if_all,
            CALCULATE (
                SELECTEDMEASURE (),
                USERELATIONSHIP ( Dim_RegionBranch[Connect], tableB[ExecRB] ),
                USERELATIONSHIP ( Dim_RegionBranch[Connect], tableA[ExecRB] ),
                USERELATIONSHIP ( Dim_RegionBranch[Connect], Target[ExecRB] ),
                USERELATIONSHIP ( Dim_RegionBranch[Connect], Customer[ExecRB] ),
                NOT ( ISBLANK ( tableB[ExecRB] ) ),
                NOT ( ISBLANK ( Target[ExecRB] ) ),
                --not(isblank( Customer[ExecRB])),  
                NOT ( ISBLANK ( tableA[ExecRB] ) )
            ),
        if_rgm, if_rgm_value,
        if_rgm_ka, if_rgm_ka_value,
        if_bgm, if_bgm_value        
    )