Error creating embed token for report using effective identity

Hello,

I'm trying to embed all of the reports in a workspace, in an 'App Owns Data' scenario.  The reports use an on-prem SSAS model as a source, which has RLS defined in the model using roles.  My understanding from this documentation is that I should be able to pass in an EffectiveIdentity to the GenerateTokenRequest method where I specify the username, role to use and dataset id.  However, when I do this I'm getting the following error: "Creating embed token for accessing dataset xxxx-xxxx-xxxx-xxxx shouldn't have effective identity".

This is the code that I'm using:

var generateTokenRequestParameters = new GenerateTokenRequest("view", null, identities: new List<EffectiveIdentity> { new EffectiveIdentity(username: username, roles: new List<string> { "PBITest" }, datasets: new List<string> { report.DatasetId }) });

var tokenResponse = client.Reports.GenerateTokenInGroupAsync(groupId, report.Id, generateTokenRequestParameters).Result;

I'd really appreciate some help on finding where I've gone wrong...

Thanks!