How to use Power BI Rest API without GUI authentication (redirect uri)

This is a very useful discussion, especially regarding the apps that my company develops, which are typically Windows services running on some headless datacenter server that doesn't usually have user interaction or a gui.  

Consider a simple example: you have a service running that collects performance monitor stats from one or more servers and you want to ship those off via direct push to Power BI.  You might have a UI available when you installed the app, but it's not something that you'll be able to or want to return to in order to update a token.

Many of the approaches mentioned below are good, but are now outdated:

• AcquireTokenByRefreshToken() that aevers describes is no longer implemented in ADAL 3.
• The user name/password AAD flow that jocaplan-MSFT mentions is no longer supported in ADAL3 (UserCredential class doesn't contain passwords any longer), although you can still access it by using ADAL 2.   However username/password can be problematic, because we've seen that AAD may require additional authenication steps (2FA, or smart cards in the case of Microsoft, etc.) which is I'm sure why MSFT dropped it from ADAL3.

I may be missing some alternative approaches, so if there's a better way to handle authentication, please let me know.  I'm new to Power BI  :).

In the ideal case, a Power BI app would require user authentication/acceptance to the rights requested at install time.  And from that point on, it would not require any additional user interaction via a GUI.  Users could terminate access by removing the application from their accepted application list.

In the case of AAD applications, it functions pretty much like this.  Our app requires admin-level approval to add them to the organizational application list, but from that point on we can access AAD without further prompting.  If this was applied to Power BI, I'm sure there would be some additional work/thinking required because:

• Just because an app was added to an organization doesn't imply that that app should have access to all Power BI workspaces.  Perhaps a workspace needs a token that can be supplied to external applications to use in an http request.
• Sometimes having to request an admin to add an application to an organization can be troublesome, especially if the application is really only for one user's workspace. Ideally a user could allow access for a single user's application without admin interaction.

So my ask in this message is to help me clear up my understanding on what is possible and the recommended approach for apps like mine today.  Also, want to raise this issue again now that the technology has evolved to see what if anything is on the roadmap.

I did this by using the refresh token provided by the GUI authentication process and only using the AcquireTokenByRefreshToken method in my worker with the this token. I now just have to refresh the RefreshToken after a few days and update the configuration of my cloud worker (stored in redis -> worker checks for updated token). I do not re-use the Refresh Token in the configuration for every authentication request though but the new ones provided by AcquireTokenByRefreshToken.

Below is the code for getting AccessToken by giving User credential, client Id (without AccessCode & Azure-Login UI).

using Newtonsoft.Json;
using System.IO;
using System.Text;

private async void SetAccessToken()
{
List<KeyValuePair<string, string>> vals = new List<KeyValuePair<string, string>>();
vals.Add(new KeyValuePair<string, string>("grant_type", "password"));
vals.Add(new KeyValuePair<string, string>("scope", "openid"));
vals.Add(new KeyValuePair<string, string>("resource", "https://analysis.windows.net/powerbi/api"));
vals.Add(new KeyValuePair<string, string>("client_id", ""));
vals.Add(new KeyValuePair<string, string>("client_secret", ""));
vals.Add(new KeyValuePair<string, string>("username", ""));
vals.Add(new KeyValuePair<string, string>("password", ""));
string TenantId = "";
string url = string.Format("https://login.windows.net/{0}/oauth2/token", TenantId);
HttpClient hc = new HttpClient();
HttpContent content = new FormUrlEncodedContent(vals);
HttpResponseMessage hrm = hc.PostAsync(url, content).Result;
string responseData = "";
if (hrm.IsSuccessStatusCode)
{
Stream data = await hrm.Content.ReadAsStreamAsync();
using (StreamReader reader = new StreamReader(data, Encoding.UTF8))
{
responseData = reader.ReadToEnd();
}
}
Token = JsonConvert.DeserializeObject<AccessToken>(responseData);
}

public class AccessToken
{
public string token_type;
public string scope { get; set; }
public string expires_in { get; set; }
public string expires_on { get; set; }
public string not_before { get; set; }
public string resource { get; set; }
public string access_token { get; set; }
public string refresh_token { get; set; }
public string id_token { get; set; }
}

Hi all,

with regards to the original subject, silent authenntication and also embedding PowerBI, i want to mention how i managed to get this to work and hopefully may help someone.

The way i managed to get silent authentication to work for embedding report items into a custom application was to use a master powerBI account (created via Office 365) and then setup a Native App in Azure Active Directory (AAD) and make the master account be the owner of the Native App and set the correct permissions in the app and generate a Key.

you then need to make a POST request to https://login.microsoftonline.com/common/oauth2/token with the following Keys and Values:

You can test out your POST request by using the software application 'Postman'.

This will return back a the access token.

You then use the access token to pull back a Dashboard, Report or Tile - but bearing in mind that in PowerBI the Report / Dashboard must be bundelled into a PowerBI APP and owned by the Master Account - otherwise this won't work.

<html>
<script src="https://microsoft.github.io/PowerBI-JavaScript/demo/node_modules/jquery/dist/jquery.js"></script>
<script src="https://microsoft.github.io/PowerBI-JavaScript/demo/node_modules/powerbi-client/dist/powerbi.js"></script>
<script type="text/javascript">
window.onload = function () {
var embedConfiguration = {
    type: 'dashboard', //  dashboard
	//change report embed url to dashboard embed url
    accessToken: 'TOKEN GENERATED FROM POST REQUEST GOES HERE',
    embedUrl: 'https://app.powerbi.com/dashboardEmbed?dashboardId=YOUR DASHBOARD ID - You can find this out by using http://docs.powerbi.apiary.io/ '  
	}; 
var $reportContainer = $('#dashboardContainer');
var report = powerbi.embed($reportContainer.get(0), embedConfiguration);
}

function reloadreport(){
	var element = $('#dashboardContainer');
	alert(element);
	var report = powerbi.get(element);
	report.reload().catch(error => {console.log(error)  });
};
</script> 
<div id="dashboardContainer"></div>
</html>  

Hope this helps someone.

Shaheen K

Has anyone managed to do a silent auth using angular 4?