Forum Discussion
Microsoft EmployeeHow to use Power BI Rest API without GUI authentication (redirect uri)
You can use the user name and password flow that AAD supports. This 3rd party client library has an example: https://github.com/Vtek/PowerBI.Api.Client
Advocate IIThis is a very useful discussion, especially regarding the apps that my company develops, which are typically Windows services running on some headless datacenter server that doesn't usually have user interaction or a gui.
Consider a simple example: you have a service running that collects performance monitor stats from one or more servers and you want to ship those off via direct push to Power BI. You might have a UI available when you installed the app, but it's not something that you'll be able to or want to return to in order to update a token.
Many of the approaches mentioned below are good, but are now outdated:
- AcquireTokenByRefreshToken() that aevers describes is no longer implemented in ADAL 3.
- The user name/password AAD flow that jocaplan-MSFT mentions is no longer supported in ADAL3 (UserCredential class doesn't contain passwords any longer), although you can still access it by using ADAL 2. However username/password can be problematic, because we've seen that AAD may require additional authenication steps (2FA, or smart cards in the case of Microsoft, etc.) which is I'm sure why MSFT dropped it from ADAL3.
I may be missing some alternative approaches, so if there's a better way to handle authentication, please let me know. I'm new to Power BI :).
In the ideal case, a Power BI app would require user authentication/acceptance to the rights requested at install time. And from that point on, it would not require any additional user interaction via a GUI. Users could terminate access by removing the application from their accepted application list.
In the case of AAD applications, it functions pretty much like this. Our app requires admin-level approval to add them to the organizational application list, but from that point on we can access AAD without further prompting. If this was applied to Power BI, I'm sure there would be some additional work/thinking required because:
- Just because an app was added to an organization doesn't imply that that app should have access to all Power BI workspaces. Perhaps a workspace needs a token that can be supplied to external applications to use in an http request.
- Sometimes having to request an admin to add an application to an organization can be troublesome, especially if the application is really only for one user's workspace. Ideally a user could allow access for a single user's application without admin interaction.
So my ask in this message is to help me clear up my understanding on what is possible and the recommended approach for apps like mine today. Also, want to raise this issue again now that the technology has evolved to see what if anything is on the roadmap.
ChrisWilliams I came here to post this exact thing. I can't find a simple way to "silent" authenticate because of these issues. Is there a standard approach for this now? Do we need to submit a feature request?
shaunwilksHelper V
How did you go with this ?
Were you able to find a way to silentyly authenticate a user of the PowerBi service ?
What was your solution to avoiding a mandatory GUI login ?
Shaun,
There are a couple steps needed to silently authenticate.
1. You need to manually log in with the account once because PowerBI will prompt you with permissions. Once you've accepted, the account can be set up for silent authentication.
2. In c#, aquire the token like this
// Create an instance of TokenCache to cache the access token TokenCache TC = new TokenCache(); // Create an instance of AuthenticationContext to acquire an Azure access token authContext = new AuthenticationContext(authority, TC); string resourceUri = "https://analysis.windows.net/powerbi/api"; string clientID = "your client id here"; string email = "your email here"; string password = "your password here"; // Call AcquireToken to get an Azure token from Azure Active Directory token issuance endpoint token = authContext.AcquireToken(resourceUri, clientID, email, password).AccessToken;
If you perform these steps properly, you can do whatever you want in the background. I have this in an executable file that's triggered by my database any time there is new data that I want to push out to a PBI dataset.
- shaunwilks
I have largely followed the following post in our integration.
https://powerbi.microsoft.com/en-us/documentation/powerbi-developer-get-azuread-access-token/
Do the steps you detail above to achieve silent Powerbi login also apply if our architecture falls into the
Access token for Power BI users (user owns data)
category from the article link I posted ?
Ours is an an application written and distrubuted to our clients who all have their own Powerbi pro accounts and content.
We are just wanting a way they can consume their content within our application and not have to log in each and every time.
Big thanks in advance for your previous post and any response
- Phil_Seamark
Hi have found a way using SSIS that should work from anywhere. I will write a blog on the www.radacad.com site and post here the details.
Hey Phil! Sorry for reviving this old post 😅 but can you send me the link of your article? I haven't found it in the site
Thanks in advance
