Forum Discussion

rpiboy_1's avatar
rpiboy_1
Helper V
9 months ago

Custom Connector, Gateway & OAuth

I have a custom connector where OAuth works fine via Desktop. However, while attempting to implemement it via an On-Premise Gateway running in enterprise mode on WinServer '25 I'm running in a handshake failure in the Service when attempting to create my connection.

When I click "Edit Credentials" in the Create Connection dialog in the Service a secondary browser window flashes and closes, presumably this would be the window where I grant access. With some error handling, it seems that I'm not getting the auth code back from the redirect.

I'm not using PKCE as Atlassian does not support it, I I beleive that I could go the route of building an external app to handle the authentication to Atlassian, then just pass everything into Power Query but I was really hoping to avoid doing that. This connector is meant to stay "private" (I'm not trying to get it certified).

Here is the error message I get in the connection dialog:
"ConnectorTestbed: [NoCodeInCallBack] The OAuth callback URI did not contain an authorization code." 

For reference here is my finish login code where the error is occuring:

    FinishLogin = (context, callbackUri, state, OAuthConfig as record) =>
        let
            Parts = Uri.Parts(callbackUri)[Query],
                
            Code =
                try
                    Parts[code] otherwise Error.Record(
                        "NoCodeInCallback",
                        "The OAuth callback URI did not contain an authorization code.",
                        [ Parts = Parts ]
                    ),

            Result =
                if Record.HasFields(Parts, "error")
                then error Error.Record(
                    Parts[Error],
                    if Record.HasFields(Parts, "error_description")
                    then Parts[error_description]
                    else "OAuth authorization failed",
                    Parts
                )
                else if not Record.HasFields(Parts, "code")
                then error Error.Record(
                    "NoCodeInCallBack",
                    "The OAuth callback URI did not contain an authorization code.",
                    [
                        callbackUri = callbackUri,
                        QueryParameters = Parts,
                        AvailableFields = Record.FieldNames(Parts)
                    ]
                )
                else
                    TokenMethod(Parts[code], OAuthConfig)

Any suggestions would be helpful, I think I've trolled many of the sources on OAuth & Power Query, so hoping for some fresh eyes and feedback. As noted, this all works fine in the Desktop Environment. ๐Ÿ˜ž 

9 Replies

  • As the error message says - if you provide your own callback URI then you need to make sure whatever is at that URI will respond correctly to the callback.

    • rpiboy_1's avatar
      rpiboy_1
      Helper V

      The callback URI should be supplied via the OAuth workflow, I don't supply it, the return of the value is baked into Power BI's handling of OAuth.

      I modfied my error message to include the full URI callback string and in reviewing the results its not actually the callback URI, it is the initiation URI that is passed as part of starting the process. Basically it is attempting to iniaiate the process, but then fails and goes straight to the Finish step (so not really a very elegant failure mode). This would align with the fact that a browser window appears briefly where I should be able to grant access as part of the OAuth workflow, but that window quickly disappears.

       

      For anyone curious the URI contains the key for code, but there is no value, response_type is also blank.

      Thus the question is, does anyone have tips on how to deal with the fact that there seems to be some issue with iniatiting the OAuth workflow, or is this simply one of the litany of issues with the OAuth workflow?

      • v-nmadadi-msft's avatar
        v-nmadadi-msft
        Community Support

        Hi rpiboy_1  ,
        Thanks for reaching out to the Microsoft fabric community forum.

        There is a limitation related to On-prem Gateway and Oauth, please check if it is related to the error you are facing
        When you use OAuth2 credentials, the gateway currently doesn't support refreshing tokens automatically when access tokens expire (one hour after the refresh started). If you get the errors "InvalidConnectionCredentials" or "AccessUnauthorized" when accessing cloud data sources using OAuth2 credentials even though the credentials were updated recently, you might be hitting this error. This limitation for long running refreshes exists for both VNet gateways and on-premises data gateways.
        Troubleshoot the on-premises data gateway | Microsoft Learn

        I hope this information helps. Please do let us know if you have any further queries.
        Thank you

  • Hi rpiboy_1 ,
    Could you please confirm if the issue has been resolved after raising a support case? If a solution has been found, it would be greatly appreciated if you could share your insights with the community. This would be helpful for other members who may encounter similar issues.

    Thank you for your understanding and assistance.