topic Re: Fabric notebook connection to API that requires mTLS authentication in Data Engineering

Fabric notebook connection to API that requires mTLS authentication

arlindTrystar — Tue, 25 Mar 2025 11:48:13 GMT

I need to connect to an API that requires mTLS authentication. I have stored the certificate in Azure Key Vault, and I can retrieve it this way:

certificate = mssparkutils.credentials.getSecret('https://<name>.vault.azure.net/', 'certification-name')

So, when I perform a GET request like this:

requests.get('https://api.endpoint.com/example', headers=headers, cert=cert)

I get this error:

OSError: Could not find the TLS certificate file, invalid path: [REDACTED]

How can I solve this?

The problem is that this certificate value is redacted: https://learn.microsoft.com/en-us/fabric/data-engineering/author-execute-notebook#secret-redaction

Re: Fabric notebook connection to API that requires mTLS authentication

spencer_sa — Tue, 25 Mar 2025 14:16:36 GMT

Theoretically a Key Vault secret is only [Redacted] if you try to print() it*. You should be able to use it 'as is'.
How are you getting from certificate to cert? Is cert an actual path in your output? Can you print the path?

From the link below, the cert parameter appears to need to be a tuple of the certificate path and the key path.
python requests library mtls

If you're storing the cert / key in the key vault you may need to write these to a temporary file location for the requests to pick them up? (I've not seen methods of just adding the cert to a loaded string)

* I'm not going to speculate about any bypass methods.

Re: Fabric notebook connection to API that requires mTLS authentication

arlindTrystar — Tue, 25 Mar 2025 15:00:28 GMT

Thank you for your response. Yes, for now it looks like the only option is to write the certificate content to a temporary file location and then pass that file location to the requests library.

However, now the client_secret and client_id that I get from azure key vault are 'REDACTED' and when I pass them to the requests library, it does not work. This is what I'm researching for now.

But yes, for anyone interested, you should write the certificate to a temporary file and then pass it to requests library. Something like this:

with tempfile.NamedTemporaryFile(delete=False) as cert_file: cert_file.write(certificate.encode()) cert_file.flush() cert_path = cert_file.name

where 'certificate' is the certificate content, and the cert_file is the temporary file path, and then you pass cert_file to requests library