Forum Discussion

ricus_zero's avatar
ricus_zero
New Member
7 years ago
Solved

App only authentication - oAuth2 token request

Hi everyone   I'm making use of app-only authentication (the app owns data method), I've already set up a new group and created a service principle, as well as enabled the "Allow service principle ...
Need Help
ricus_zero's avatar
ricus_zero
New Member
7 years ago

Hi Jayendran 

 

Thanks for the prompt response!

 

I noticed your token endpoint is the v1 endpoint and not the /oauth2/v2.0/token one, is there a reason for that?

 

That screenshot helped a lot, I was able to get an access token using the token endpoint you used (not v2), but the same does not work for v2, do you know why this might be? 

 

Regardless, after I got the access token I attempted getting a list of reports making a GET request to https://api.powerbi.com/v1.0/myorg/reports - but I'm getting the following response:

 

 

The app is part of a group to which I have given access inside of the tenant settings in PowerBI, am I missing something?

 

I'd like to mention again the end result here is for me to get embed urls for reports and dashboards, I think the endpoint I was checking is what I need but I might be wrong. 

 

I noticed this section in the documentation regarding embed tokens, but that requires scopes that we did not supply with the token request? 

 

Thanks again for the help

Jayendran's avatar
Jayendran
Solution Sage
7 years ago

Hi ricus_zero 

 

As per microsoft they used v1. So It's a standard for us to use V1 whenever we login using microsoft.

 

Coming back to your error..

There are many difference in pro account autentication and SPN autentication.I'd recommed you to refer that

 

Actually you are calling a API https://api.powerbi.com/v1.0/myorg/reports  which is My Workspace This is the default workspace given to your account by PowerBI.

 

SPN won't able to access My Workspace, because you can only able to access it, not a service account/SPN.

 

What you can do now ?

  1. Create a new workspace
  2. Add the SPN as the Admin to the new workspace
  3. Publish the report in that workspace
  4. Call the REST API GET https://api.powerbi.com/v1.0/myorg/groups/{groupId}/reports/{reportId} which the SPN token
  • ricus_zero's avatar
    ricus_zero
    New Member
    7 years ago

    Hi Jayendran 

     

    Once again coming in with the rock solid response.

     

    Now that you mention it that makes a lot of sense, so in essence, we would require a pro account because only pro accounts can create new workspaces?

     

    For the time being, I've enabled the trial pro account to test this out.

     

    I created a new workspace, when it comes to assigning the service principle as admin to the new workspace, It's not picking it up in the auto complete? Is this feature available on the gui yet? (I remember from a video I watched, that a few months back this wasn't possible from the interface and the SPN had to be added via PowerShell)

     

    For reference, I have a group called Power BI Apps, which has been added under tenant settings:

     

     

    In Azure AD when I navigate to this group and click on members, I can see the service principle there

     

    When attempting to add this it's not picked up, is this because it's not possible from the gui?

     

    Regards

     

    • Jayendran's avatar
      Jayendran
      Solution Sage
      7 years ago

      Hi ricus_zero 

       

      Even SPN can able to create new workspace (V2). If you refered the difference between pro and SPN . you can find that solution.

       

      There are 2 types of workspaces

      1. Classical (v1)
      2. Upgraded (v2)

      PRO have access to both workspace, but SPN should have only v2 workspace. So if you are trying to add your your SPN in V1 workspace it won't work/ show. 

       

      You can add the SPN only in the V2 (Upgraded workspace) (from GUI)

       

      Pls see the below screenshot I can able to search the app id in my V2 workspace

       

      • ricus_zero's avatar
        ricus_zero
        New Member
        7 years ago

        Hi Jayendran 

         

        Sorry for all the questions, your help has been tremendous so far! 

         

        Am I correct in saying that it's possible for a normal license to create new workspaces via the service principle? (API call)

         

        I attempted to create a new workspace via the REST API, making a call to the groups endpoint which got a 403 initially, I tried my luck and added the required scope to the access token call, and magic happened, I could now create a new workspace via the api, and then I assigned this workspace to my PowerBI user so that they can view it as well.

         

        I added some of the sample dashboards and reports to this new workspace that was created via the api

         

        So moving on from that, I then attempted to get the dashboard with the get dashboard endpoint, and got that "API is not accessible for application" response again. 

         

        I then had a look at the Embed Token documentation since it's relevant to the App owns data scenario which if I'm not mistaken is what we are dealing with here.

         

        I attempted to get an embed token for said dashboard. I once again had to change the scopes defined when getting the oauth access token, but after that I was able to get a proper response which includes the token / tokenId / expirtation and @odata.context

         

         

        Now a seemingly simple question of, how do I actually use this embed token in our web app to display the embedded dashboard?

         

        Hope you can help with this

         

        Thanks