Forum Discussion
Authorization Code Grant Flow (Power BI Embedded)
The Authorization Code Grant Flow is used to authenticate the current user but never the master user account. Therefore, the Authorization Code Grant Flow is used for first-party embedding with the user-owns-data model and never with third-party embedding and the app-owns-data model.
If yiu are using third-party embedding, you should use the User Credential Flow which is not an interactive flow. Here is a simple example.
public class PbiEmbeddedManager {
private static string aadAuthorizationEndpoint = "https://login.microsoftonline.com/common";
private static string resourceUriPowerBi = "https://analysis.windows.net/powerbi/api";
private static string applicationId = ConfigurationManager.AppSettings["application-id"];
private static string userName = ConfigurationManager.AppSettings["aad-account-name"];
private static string userPassword = ConfigurationManager.AppSettings["aad-account-password"];
private static string GetAccessToken() {
AuthenticationContext authenticationContext = new AuthenticationContext(aadAuthorizationEndpoint);
AuthenticationResult userAuthnResult =
authenticationContext.AcquireTokenAsync(
resourceUriPowerBi,
applicationId,
new UserPasswordCredential(userName, userPassword)).Result;
return userAuthnResult.AccessToken;
}
}Another key point is that you must grant permissions (i.e consent) to the Azure AD application for the master user account before you run this flow because this flow will fail if Azure AD attempts to prompt the user to consent to the application's required permissions.
I assume you are using third-party embedding and the app-owns data model and not first-party embedding with the user-owns-data model. Is this correct?
Hi Ted! Thanks for your detailed response with code examples. Something I think would be useful and would allow anyone to implement this flow in any language would be an example REST API call with the payload outlined and possibly where to acquire each component of that payload.
I've been searching for a week off and on and it's extremely frustrating for something so simple as getting a bearer token to make requests to be so obscure or only represented in Java/C# or other lower-level languages where you utilize a library from Microsoft. Often times with no reference on where to obtain those libraries, how to use them, where this code should run... etc
Is there any documentation on that specifically? Or would you be so kind as to give us this example?
Signed,
a very frustrated developer who has set up this exact situation using other services and has never had this much trouble.