If you select Power BI as your reporting tool, you can choose between a live and an import connection for most data sources. No analysis authorizations are transferred for SAP BW or SAP BW/4Hana data during import. This raises the question of whether it is possible to import SAP analysis authorizations from SAP. In this blog, I would like to present such a possibility. This is particularly helpful for complex authorization concepts.
In Power BI, authorizations are available at row level (RLS) and object level (OLS). Authorizations at the object level (OLS) determine access rights to tables or columns, and authorizations at the row level (RLS) – restrict data access at the row level. The task is therefore to save the SAP analysis authorizations as RLS or OLS and reduce the manual effort.
The authorizations can be added as usual in the Power BI role or they can also be integrated into Power BI via external tools.
«Tabular Editor» – is an alternative editor to SSDT to create tabular models for Analysis Services even without Workspace Server (open source version).
Tabular Editor 3» – is the commercial version of the tool with many additional productivity features for Analysis Services and Power BI table modeling.
DAX or C# script functions can be used to import authorizations.
These tools also enable the import of entire data models including role authorizations.
In SAP BW and SAP BW∕4HANA systems, defined analysis authorizations can be imported to SAP Datasphere. To do this, analysis authorizations are stored in the authorization table table RSDWC_RSEC_DAC.
This function is only supported for SAP BW v7.5 SP 16 and higher systems and SAP BW∕4HANA v2.0 and higher systems.
The entries from the table can also be used for the import to Power BI. The corresponding analysis authorizations should first be extracted in transaction RSDWC_DAC_RSEC_GEN:
Both the object structure and the filters are saved in the RSDWC_RSEC_DAC table.
Filter information is relevant for the import into Power BI.
First, the format should be adapted. The table is available for the ABAP connection so that the data can be formatted in an ABAP program and saved in a file. In this way, several analysis authorizations can be retrieved and saved in a loop, which of course reduces the manual effort enormously.
Finally, the analysis authorizations are transferred to a role in Power BI. Depending on the complexity and script format, they are added via copy-paste or file import.
In Power BI Service Portal, users, groups, or individual users can be assigned to a role.
Not only internal users can be added to the role, but external users can also be invited. To do this, the External sharing setting must be activated.
Roles can be tested in the Power BI Service Portal with different user accounts or in the external tool DAX Studio.
The video shows a demo report and explains the individual steps involved in importing analysis authorizations from SAP BW.