Forum Discussion

kaouter's avatar
kaouter
Frequent Visitor
4 months ago
Solved

Fabric - Airflow Jobs - Notebook Access to Key Vault -mssparkutils.credentials.getSecret returns 403

Hi all, I've been hitting a 403 Forbidden error when calling mssparkutils.credentials.getSecret from a Fabric notebook triggered via Apache Airflow. The error message includes a caller appid (caxxxx...
data engineering
data pipeline
notebook
  • tayloramy's avatar
    tayloramy
    4 months ago

    Hi kaouter, 

     

    As we discussed on Discord, Fabric uses the security context of the identity that calls the API to trigger the notebook to access the keyvault. 

     

    In your case, when you have an airflow SPN triggering the notebook, that SPN is the identity that needs permissions on the keyvault for the notebook to be able to successfully authenicate to the keyvault. 

     

    It was great connecting with you on Discord and being able to help! 

tayloramy's avatar
tayloramy
Icon for Super User rankSuper User
4 months ago

Hi ssrithar, 

 

None of those links make any reference to Fabric creating new session specific identities for auth. 

 

Please fact check before you post content on the forums, especially if it is generated from an LLM.  Spreading misinformation is not helpful for the community.