Implementing custom authentication and authorization with Power BI Report Server

PowerBI is a the new Microsoft product for the reports design and deployment, composed by a server part that can be on cloud or On-Premise and PowerBI Desktop that is the client used to design the reports.

The Report Server (On-Premise) consists in web based interface to access and visualize the reports, protected by an authentication layer that need to be configured; we have two options about that, the first one is using our LDAP directory and enable the windows authentication; the second one is configure a custom authentication and implementing a piece of code (or use an existing one) that authenticate the user on the company directories.

In order to implementing the custom authentication, we have some steps to do about the code development and others about the server configuration.

Code development

We can start by downloading the Microsoft custom security sample project from GitHub.

In this project we’ll find a Logon.aspx page:

The page has the user and password fields and two buttons about the login and the user registration; for example we can change the look and feel of the page based on company brand.

We can put our custom authentication in the method invoked by the login button, in the Logon.aspx.cs file:

Instead of the VerifyPassword method we can put a call, for example, to an our web api authentication method and validate the credentials.

Another use case is call Power BI from and external application where the user is already authenticated; the user shouldn’t relogin on power bi and the report should appear without any authentication; we can manage this by passing, for example, the authentication token in the url of the report like this:

https://PBIhostname/ReportServer/logon.aspx?ReturnUrl=/ReportServer/localredirect?url=/Reports/powerbi/report.pbix&token=123

We are calling the logon page of PBI Report Server and we are passing the ReturnUrl parameter with the url of the report and the authentication token; now we can manage this token in the PageLoad event of the Logon.aspx.cs file:

The VerifyTokenAsync method deal with the token validation, for example by calling our Web Api; if the check will be ok, then the user will be automatically redirect to the report, otherwise a new login will be needed.

Once the page layout of the login page and the authentication layer are completed, we can configure PowerBI Report Server to use the custom authentication.

Server configuration

First, we have to copy the Logon.aspx page in the ReportServer sub directory, for example:

C:\Program Files\Microsoft Power BI Report Server\PBIRS\ReportServer

Next we have to copy the dll of the project into three subfolders:

• ReportServer\bin
• Portal
• PowerBI

Then, edit the RSReportServer.config file located in the ReportServer folder; we have to modify the Authentication section like this:

<Authentication>
<AuthenticationTypes> 
<Custom/>
</AuthenticationTypes>
<RSWindowsExtendedProtectionLevel>Off</RSWindowsExtendedProtectionLevel>
<RSWindowsExtendedProtectionScenario>Proxy</RSWindowsExtendedProtectionScenario>
<EnableAuthPersistence>true</EnableAuthPersistence>
</Authentication>

In the Security and Authentication elements, modify the Extension element like this:

<Extension Name="Forms" Type="Microsoft.Samples.ReportingServices.CustomSecurity.Authorization, Microsoft.Samples.ReportingServices.CustomSecurity" >

Now we have to modify the RSSrvPolicy.config file located in the ReportServer subfolder as well and add a new CodeGroup element:

<CodeGroup
class="UnionCodeGroup"
version="1"
Name="SecurityExtensionCodeGroup" 
Description="Code group for the sample security extension"
PermissionSetName="FullTrust">
<IMembershipCondition 
class="UrlMembershipCondition"
version="1"
Url="C:\Program Files\Microsoft Power BI Report Server\PBIRS\ReportServer\bin\Microsoft.Samples.ReportingServices.CustomSecurity.dll"/>
</CodeGroup>

The last file to edit is the Web.config file, we have to change the identity element:

<identity impersonate="false" />

The authentication element:

<authentication mode="Forms">
<forms loginUrl="logon.aspx" name="sqlAuthCookie" timeout="60" path="/"></forms>
</authentication>

The authorization element:

<authorization> 
<deny users="?" />
</authorization>

The trust element:

<trust level="Full" originUrl="" />

Now the configuration is completed and after a server restart, the custom authentication will be available.

With this project we are able to customize the authorization as well; we can intercept the events about the access to resources, folders, reports and apply our business logic.

Let’s look to the changes that we have to do.

Authorization

In the project there is an Authorization.cs file with some CheckAccess methods used by PowerBI Report Server to verify if a user is authorized to do a specific operation.

We can leverage these methods to implements our custom business logic; for example che custom authentication do not allow the use of groups, we don’t have an LDAP directory, so it’s impossible to it to resolve any group; but with a piece of code and these events we can solve the problem.

Suppose to store the user tokens used in previous chapter in a txt file; then we implement a method that accept two parameters, the username and the access entry to be check:

private bool IsMember(string username, string group)
{
var path = Directory.GetParent(Path.GetDirectoryName(AppDomain.CurrentDomain.BaseDirectory)).FullName + @"\ReportServer\tokens.txt";
if (File.Exists(path))
{
var tokens = JsonConvert.DeserializeObject<List<Token>>(File.ReadAllText(path));
var token = tokens.FirstOrDefault(t => t.Username.ToLower() == username.ToLower());
if (token != null)
{
var client = new HttpClient();
client.BaseAddress = new Uri(token.UrlServerSin);
client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", token.Access_token);
var message = client.GetAsync(".....").Result;
if (message.StatusCode == HttpStatusCode.OK)
{
var groups = JsonConvert.DeserializeObject<string[]>(message.Content.ReadAsStringAsync().Result);
var enabled = groups.Any(g => g.ToLower() == group.ToLower());
return enabled;
}
}
}
 return false;
}

With the user token we can retrieve the user groups with our specific api and then check if the access entry is one of these.

Then, we can use this method in the events that we want to manage, for example the access of a folder:

With this change, when a user try to access to a folder where the security is defined with groups, the CheckAccess method is fired and with the custom method is checked if the user is member of a specific group.

We can do the same things for others components like reports.

Summary

The customization of the Power BI Report Server authentication allow to modify the layout of the login page, the business logic of the login phase (for example by calling a web api to login) and the business logic of the authorization mechanism.

With these elements we can customize the behaviour of the enviroment to fit to the comany requirements.