Getting access token for user owns data (UOD) using JavaScript

[austinhag]

I'm trying to prototype Power BI Embedded with User Owns Data (UOD) using Javascript.  The provided sample on Github (https://github.com/Microsoft/PowerBI-JavaScript) works great; however, I'm not able to determine how they are getting the access token from the APIs. Which calls do I need to make with JavaScript to get the access token?

[v-jiascu-msft]

Hi @austinhag,

1. For the purpose of demo, these parameters including embed token are predefined and are updated automatically.

2. How can we get the embed token? Please refer to https://www.youtube.com/watch?v=GPHHdDRSlis and Embed-API-Sample.

3. The pure Javascript approach of getting access token could be azure-activedirectory-library-for-js.

Best Regards,

Dale

[austinhag]

Further, looking at the OAuth 2.0 documentation, I assume that that for Power BI UOD embedded, we should be using the "Authorization code" grant type (as opposed to "Client credentials"). However, what's interesting is that I assume the resulting access token needs to be passed back to the browser so that the subsequent calls to powerbi.embed can be made using it.   

[mittalpatel130]

@austinhag  - Could you identify which grant type to use in this scenario? I'm using ADAL.js to get the access token using "Client Credentials" but it returns id_toekn in Browser URL. I'm not sure how to get it from browser to load the tiles on javaScript page. 

[austinhag]

Thanks Dale for the reply!  I have all the components of the AAD approach in place except for the access token creation.  I have my app all setup and registered in AAD as required.  I also used the PowerBI-Developer-Samples code to test and grab the dashboard ID and embed URLs and confirmed that those work in my app (I'm able to see the tiles in my app using those IDs and the temporary access token generated by the sample code), etc.  However, I was assuming/hoping that the access token generation would be part of a standard javascript library such the powerbi-client Javascript library.  It sounds like it is not.  I will use the ADAL to generate it.  Perhaps this is because the token generation process would ideally be split between the browser and server with browser managing AAD sign-in, receiving the authorization code, passing that to the server which obtains the access token on behalf of the user (thus keeping the client ID and secret hidden)?  The browser then receives the access token from the server and uses it to request Power BI tiles, etc.  Is that the ideal flow?