Forum Discussion

Anonymous's avatar
Anonymous
Not applicable
4 years ago

Power BI Api - JWT Auth

Hey There,

 

I hope someone can/are willing to help me out. 

 

I'm trying to connect to Power BI's API using a service principal account and I understand in order to do this I need to use a JWT token to auth. I am getting the following error when I try to connect:

 

 

Client assertion audience claim does not match Realm issuer. Review the documentation at https://docs.microsoft.com/azure/active-directory/develop/active-directory-certificate-credentials .

 

 

I've done quite a lot of reading up and I just can't figure out what I'm doing wrong. Here's my token's output.

 

 

 -headers: Lcobucci\JWT\Token\DataSet^ {#1882
    -data: array:4 [
      "typ" => "JWT"
      "alg" => "RS256"
      "x5t" => "SSL_FINGERPRINT"
      "kid" => "SSL_FINGERPRINT"
    ]
   }
  -claims: Lcobucci\JWT\Token\DataSet^ {#1096
    -data: array:8 [
      "iss" => "CLIENT_ID"
      "sub" => "CLIENT_ID"
      "aud" => array:1 [
        0 => "https://login.microsoftonline.com/TENANT_ID"
      ]
      "jti" => "UNIQUE TOKEN"
      "iat" => DateTimeImmutable @1639991673 {#695
        date: 2021-12-20 09:14:33.002124 UTC (+00:00)
      }
      "nbf" => DateTimeImmutable @1639991733 {#2329
        date: 2021-12-20 09:15:33.002124 UTC (+00:00)
      }
      "exp" => DateTimeImmutable @1639995273 {#2087
        date: 2021-12-20 10:14:33.002124 UTC (+00:00)
      }
    ]

 


And I'm posting with these values

 

URL: https://login.windows.net/{$tenant_id}/oauth2/token

 

'resource' => 'https://analysis.windows.net/powerbi/api',
'client_id' => $client_id,
'grant_type' => 'client_credentials',
'client_assertion_type' => 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer',
'client_assertion' => $client_assertion,

 

 

Thanks.

Kyle

3 Replies