Forum Discussion

luwa's avatar
luwa
Frequent Visitor
8 years ago
Solved

grant_type must be "password" and app level permissions

Hi all,

 

I am trying to call PBI REST APIs such as https://api.powerbi.com/v1.0/myorg/groups or delet tows in a dataset.

The access token I acuiqred using `grant_type: client_credentials`, and passing `client_id`, and `client_secret` doesn't return with `scope` claim, hence when calling the PBI endpoints, it's 401.

 

But if I acquire the token using `grant_type: password`, and pass in my own credentials in addition to the client_id and secret, the token returned then contains `scope` and I can call the PBI ednpoint successully.

 

On AAD, my app has only "Delegation Permission", no "Application Permission".

 

Question:

Is it true that calling PBI APIs, the token acquired must use the `grant_type: password`?

In other words, the there must be a user context for calling the APIs?

 

My goal is to write a Logic App (worker) to delete rows in my PBI dataset.

Hence GUI consent giving isn't an option. And having to put my own credentials in to obtain the correct token seems unsustainable. 

 

Thank you for your time!

  • ericleigh007's avatar
    ericleigh007
    8 years ago

    We use a service account that has access to PowerBI for this.  We have MFA turned on almost all accounts, but off for service accounts.

     

    It apears to be true that one needs the password grant type.

     

    And for extra fun, the AAD library no longer supports it.   "UserCredential" is no lnoger there.

     

    So what you must do is issue a regular old HTTPS POST to the authority URL, and a body like this:

     

                string authBody = $@"
			grant_type = password
			&resource ={WebUtility.UrlEncode(resourceString)}
			&username ={WebUtility.UrlEncode(username)}
			&password ={WebUtility.UrlEncode(password)}
			&client_id ={clientId}
            &client_secret={ WebUtility.UrlEncode(secret)}";

    With this information, becuase you're including a client secret, there will be no prompt necessary.

     

    Good luck.

    -e

8 Replies

  • ericleigh007's avatar
    ericleigh007
    Icon for Advocate II rankAdvocate II
    8 years ago

    We use a service account that has access to PowerBI for this.  We have MFA turned on almost all accounts, but off for service accounts.

     

    It apears to be true that one needs the password grant type.

     

    And for extra fun, the AAD library no longer supports it.   "UserCredential" is no lnoger there.

     

    So what you must do is issue a regular old HTTPS POST to the authority URL, and a body like this:

     

                string authBody = $@"
			grant_type = password
			&resource ={WebUtility.UrlEncode(resourceString)}
			&username ={WebUtility.UrlEncode(username)}
			&password ={WebUtility.UrlEncode(password)}
			&client_id ={clientId}
            &client_secret={ WebUtility.UrlEncode(secret)}";

    With this information, becuase you're including a client secret, there will be no prompt necessary.

     

    Good luck.

    -e

    • hsheikhali's avatar
      hsheikhali
      Frequent Visitor
      8 years ago

      Can you elaborate Eric? I am possibly having the same issue. What do you mean by 

      "So what you must do is issue a regular old HTTPS POST to the authority URL"?

      • WheresWally's avatar
        WheresWally
        Icon for Helper III rankHelper III
        3 years ago

        Hi Sam, 

         

        I have this working and giving me a bearer code. I can use it to access things like the activity logs. 

         

        I can't manage to get it to post rows to a push dataset though.

         

        I can push rows to the dataset if I grab the bearer code from my login using the 'try this' page, so I know my API push setup is all correct. I have all the admin settings as you've described and have the dataset and workspace (admin) shared to the application and the group it's in. 

         

        Any ideas about what else might be getting in the way? Thanks

  • luwa's avatar
    luwa
    Frequent Visitor
    8 years ago

    Thank you Eric for your reply!!!

     

    Yeah, after many tries, I believe it is true as the doc says, "Power BI permissions give an application the ability to take certain actions on a user's behalf. All permissions must be approved by a user in order to be valid." https://docs.microsoft.com/en-us/power-bi/developer/power-bi-permissions

     

    Therefore grant_type: client_credentials does not work.

     

    Here is a Postman screentshot of what to include to get the token:

     

     

    Then you would get a token with scope in it.

    "scp": "Capacity.Read.All Capacity.ReadWrite.All Content.Create Dashboard.Read.All Dashboard.ReadWrite.All Data.Alter_Any Datapool.Read.All Datapool.ReadWrite.All Dataset.Read.All Dataset.ReadWrite.All Group.Read Group.Read.All Metadata.View_Any Report.Read.All Report.ReadWrite.All Workspace.Read.All Workspace.ReadWrite.All".

     

    Even if you grant the "Application Permissions" on the Azure App Registration page, I don't think it can bypass the "user context" requirement, which means, you must have user consent and use grant_type: password to get access token.

     

    To achieve my goal, later I learned, to display the latest data for a push set, I just have to use TopN visual filter, and add a timestamp to my incoming data. 

    So in the end, I use LogicApp to pipe data to EventHub, and used Azure Stream Analytics to process further SQL queries, and then push data to PBI's stream dataset.

    Learnt it from this tutorial https://www.pluralsight.com/courses/azure-power-bi-streaming