Forum Discussion

kaouter's avatar
kaouter
Frequent Visitor
4 months ago
Solved

Fabric - Airflow Jobs - Notebook Access to Key Vault -mssparkutils.credentials.getSecret returns 403

Hi all, I've been hitting a 403 Forbidden error when calling mssparkutils.credentials.getSecret from a Fabric notebook triggered via Apache Airflow. The error message includes a caller appid (caxxxx...
data engineering
data pipeline
notebook
  • tayloramy's avatar
    tayloramy
    4 months ago

    Hi kaouter, 

     

    As we discussed on Discord, Fabric uses the security context of the identity that calls the API to trigger the notebook to access the keyvault. 

     

    In your case, when you have an airflow SPN triggering the notebook, that SPN is the identity that needs permissions on the keyvault for the notebook to be able to successfully authenicate to the keyvault. 

     

    It was great connecting with you on Discord and being able to help! 

tayloramy's avatar
tayloramy
Icon for Super User rankSuper User
4 months ago

Hi ssrithar, 

 

Instead, Fabric generates a session-specific identity that has no Key Vault permissions.


Are you able to provide a source for this behaviour? THis is the first time I've heard of Fabric creating it's own identities. A documentation link would be helpful to verify this.