Forum Discussion

g3kuser's avatar
g3kuser
Helper II
1 year ago
Solved

mssparkutils credentials library in notebook

Hi
 
With recent support of SPN authentication with Fabric ci-cd libraries, I am trying to deploy pipelines and notebook through SPN. I see the item owner as the SPN.  I have the following code in notebook which doesn't mention any credential. Is this using SPN credentials/User credential/Workspace Identity. 
 
secret_value = notebookutils.mssparkutils.credentials.getSecret(keyvault_url,'secret_name)
mssparkutils.credentials.getToken("https://api.fabric.microsoft.com/")
 
I have not given workspace identity access to key vault so I doubt if secret reading call goes that that auth.
 
I did notice in Monitoring when notebook executed through a pipeline has submitted user for notebook execution as SPN who is the item owner as well.
 
Can anyone help me in understanding the process?
 
Thanks,
 
Gayatri
 
Data Engineering
Notebook
  • nilendraFabric's avatar
    nilendraFabric
    1 year ago

    Hi g3kuser 

     

    When you call the mssparkutils credentials functions without specifying any explicit credentials or linked service parameters, the runtime automatically uses the identity under which the notebook is executing. In your case, because the notebook is being deployed and run through a Fabric pipeline configured with SPN authentication—and the SPN appears as the item owner—the mssparkutils calls are using the service principal’s credentials.

     

     

    In your current setup, since no explicit workspace identity configuration is provided (or its permissions granted for Key Vault access), the secret retrieval and token acquisition calls fall back to using the SPN credentials

3 Replies

  • nilendraFabric's avatar
    nilendraFabric
    Super User
    1 year ago

    Hi g3kuser 

     

    When you call the mssparkutils credentials functions without specifying any explicit credentials or linked service parameters, the runtime automatically uses the identity under which the notebook is executing. In your case, because the notebook is being deployed and run through a Fabric pipeline configured with SPN authentication—and the SPN appears as the item owner—the mssparkutils calls are using the service principal’s credentials.

     

     

    In your current setup, since no explicit workspace identity configuration is provided (or its permissions granted for Key Vault access), the secret retrieval and token acquisition calls fall back to using the SPN credentials

    • g3kuser's avatar
      g3kuser
      Helper II
      1 year ago

      Thank you for the explanation. As the executing user is SPN I am unable to understand how token was retrieved without the need of client secret to be supplied for the process. 

  • g3kuser's avatar
    g3kuser
    Helper II
    1 year ago

    Hi nilendraFabric 

    I am curious to understand how it worked without the need for client secret to be passed to the process.