Is there a way to add support for reverse proxy authentication in a Custom connector?

Hey ECorona ,

Yes, you can enable reverse proxy authentication, but indirectly through a middleware proxy that handles the authentication and provides a secure, simplified API for Power BI to consume. Adding support for reverse proxy authentication in a custom connector (especially for Power BI or Power Platform via the Power Query SDK) is possible, but it involves architectural workarounds, as direct support is limited. 

Understanding the Limitation

Power Query custom connectors:

• Support OAuth2, Basic, and API key authentication natively.

• Do not have built-in support for reverse proxy authentication mechanisms like SSO via headers or cookies injected by a reverse proxy (e.g., Azure Application Gateway or Nginx with SAML/LDAP).

Workaround: Use a Middleware Proxy Service

Your idea is solid: create a custom middleware (e.g., in C# or Node.js) that acts as a reverse proxy with authentication logic.

Workflow Overview:

1. Client (Power BI with custom connector) →

2. Middleware Proxy (implements authentication against the target system, injects headers/tokens) →

3. Backend Server (actual data source).

Proxy Responsibilities:

• Handle login (e.g., forward cookies, inject SSO headers).

• Maintain session (with token or cookie).

• Expose a simple RESTful API to Power BI.

• Possibly cache responses for performance/security.

Benefits:

• No need to bake complex authentication into Power BI custom connector.

• Greater control over retries, auth flows, security headers, rate-limiting.

• Simplifies your connector code — it only talks to your trusted proxy.

How to Implement

In Your Custom Connector (M Code):

• Set your connector to access: https://your-proxy.company.com/api/data

• Use a simple Anonymous authentication in the connector (the proxy handles security).

• Example:

[DataSource.Kind="MyProxyConnector", Publish="MyProxyConnector.Publish"]
shared MyProxyConnector.Contents = () =>
    Json.Document(Web.Contents("https://your-proxy.company.com/api/data"));

In Your Middleware (C# Sample):

• Use ASP.NET Core with HttpClient to forward requests.

• Authenticate with the upstream server (e.g., NTLM, Kerberos, JWT, etc.).

• Cache session token for reuse.

• Expose your endpoint to Power BI.

Things to Understand

• CORS isn’t an issue for desktop Power BI, but for online refresh (Power BI Service), your proxy must be internet-accessible and secure.

• Headers: If the auth system requires client IP or browser headers, Power BI won’t send those.

• Rate limiting/security: Implement authentication & authorization between Power BI and your proxy, perhaps with static tokens or IP whitelisting.

Resources

While there is no official Microsoft doc for reverse proxy support in custom connectors, these can help:

• Power Query SDK docs

• Custom Connector Authentication Kinds

• Reverse Proxy in Azure

If you found this solution helpful, please consider accepting it and giving it a kudos (Like) it’s greatly appreciated and helps others find the solution more easily.

Best Regards,
Nasif Azam