Forum Discussion
Advocate IAPI to switch tenants in an "embed for org" application
Here is a final update. I was able to upgrade the app to .NET 6.0 and also update all packages to stable versions.
To summarize:
Start with sample app at: Embed Power BI report in a Power BI embedded analytics application for your organization - Power BI and use the tutorial. Use the code provided at Github.
1) If necessary, downgrade node.js/npm to V16.20.2/V8.19.4
2) Target framework .NET 6.0 to remove dependence on out of support .NET 5.0
3) Update Microsoft.AspNetCore.Authentication.JwtBearer: 6.0.12
4) Update Microsoft.AspNetCore.Authentication.OpenIdConnect: 6.0.12
5) Update Microsoft.PowerBI.Api: 4.22.0
6) Update Microsoft.Identity.Web: 3.9.1
I will mark this response as a solution for anyone who is interested. And if anyone needs more info on how to use the REST API in conjunction with the sample, I can provide further details.
Many thanks and best wishes.
Advocate IHello v-saisrao-msft,
Thank you for your response. Yes, I have tried to access tokens for the host tenant by explicitly setting the tenantId in the the authorityURI. This does not work with ClientApplicationBase.GetAccountAsync, which I need to return the user and then acquire a token for that user. Using service principal rather than a specific user is not an option.
The documentation mentions that ITokenAcquisition.GetAccessTokenForUserAsync can be used to get tokens for guest users.
https://learn.microsoft.com/en-us/dotnet/api/microsoft.identity.web.itokenacquisition.getaccesstokenforappasync?view=msal-model-dotnet-latest
For this, I would have to switch from using Microsoft.Identity.Client to Microsoft.Identity.Web, which in turn means rewriting most of the app.
Tenant switching would be the ideal solution, so I will definitely submit the idea as you suggest.
Many thanks.
Community SupportHi, powerapps_tec,
Thank you for the confirmation.
If this post helps, then please give us ‘Kudos’ and consider Accept it as a solution to help the other members find it more quickly.
Thank you
- powerapps_tec
I'm still interested to know if anyone has used ITokenAcquisition.GetAccessTokenForUserAsync successfully as a means to allow guest users to perform operations on their host workspace objects through the REST API. I am only inferring this possibility from the documentation and have no concrete examples or evidence. I think it is in the interest of the community to keep this discussion open.
- v-saisrao-msft
Hi powerapps_tec,
Thanks for providing more context on your scenario! I completely understand the challenge you're facing with enabling guest users to perform operations on Power BI resources across different tenants.
I haven't personally used ITokenAcquisition.GetAccessTokenForUserAsync in this specific scenario, but I think it could be worth exploring. It seems like the ideal way to acquire tokens on behalf of a guest user, especially in a multi-tenant setup.
Thank you.
- powerapps_tec
Hello,
This tutorial uses the Micrsoft.Identity.Web with a .NET 5.0 app and works with a guest user.
https://learn.microsoft.com/en-us/power-bi/developer/embedded/embed-organization-app- No tenant switching is required to access workspaces in a host tenant.
- I have yet to try the REST API to perform more complex operations.
- I had to downgrade versions of node.js/npm to V16.20.2/V8.19.4.
- Finally, .NET 5.0 is out of support, so I'm not quite sure if this provides a stable foundation.
Nevertheless, this is a promising alternative if anyone else is interested!
Many thanks and regards.