Forum Discussion

AdarshPanasri's avatar
AdarshPanasri
Helper I
2 years ago
Solved

Access Key-vault in notebooks

Hello Everyone, I have few secrets in my Key vault and want to access those in fabric notebook. I dont want users to have access to key vault. I can create SPN and use that to access the vault but fo...
Notebook
  • x_mark_x's avatar
    x_mark_x
    Advocate II
    6 months ago

    do-sc , this is a great article but even after following the steps to the T, i still get a "403 Caller is not authorized to perform action on resource" error when running the notebook in the pipeline.
    Do you have any suggestions on how to solve/troubleshoot this issue?

    • do-sc's avatar
      do-sc
      Frequent Visitor
      6 months ago

      Oh hi Mark!

      I assume you have read the section about troubleshooting in the blog? Sometimes it can take a while to reflect the permissions from the Key Vault. Double check the permission level of the Service Principal on the Key Vault and ensure that the Pipeline is using the Notebook connection of your Service Principal. If you run the Notebook in the context of your user without having given additional permissions it can also result in the 403. Just beeing the owner on the Key Vault will not allow you to get a secret!

      If it is still not working I would try to call the Key Vault with your Service Principal credentials directly to see if you could get through. Maybe some other policy like a firewall is preventing you from accessing the secret and everything else is set up correctly: https://learn.microsoft.com/en-us/azure/key-vault/general/developers-guide#authenticate-to-key-vault-in-code

      • x_mark_x's avatar
        x_mark_x
        Advocate II
        6 months ago

        do-sc , thank you for your reply.

        After some further trials and errors, I got it working based on the article mentioned above.

        I noticed that while I followed every step, I used my own code for the retrieval and more precisely I used the notebookutils.mssparkutils.credentials.getSecret method instead of using 

        notebookutils.credentials.getSecret.

        As mssparkutils is an older library, and notebookutils practically replaced it (https://learn.microsoft.com/en-us/fabric/data-engineering/notebook-utilities), I guess that the getSecret method got an update as well, so it can use the custom connections, while the old version does not support that feature.

        Anyways, thank you for your help ğŸ™‚