Forum Discussion

emotix's avatar
emotix
Frequent Visitor
8 years ago
Solved

PowerBIClient Forbidden issue

Hi all,   We're investigating the user of Power BI embedded for our SaaS app. In our scenario, we own the data and our end users would be utilizing the reports as non-power-bi users.   I've been ...
  • jamesyoung's avatar
    jamesyoung
    8 years ago

    You are mixing the directions for user versus app authentication.  If you plan on the users not having accounts you don't need to pass in or use a clientID and SecretKey.  Here is a code example.  You will just need a username, password and clientID to login.  If you want to opena report and/or dashboard you also need a workspace guid.  Let me know if you have any questions.

     

     

         var credential = new UserPasswordCredential(Username, Password);

            // Authenticate using created credentials
            var authenticationContext = new AuthenticationContext(AuthorityUrl);
            var authenticationResult = await authenticationContext.AcquireTokenAsync(ResourceUrl, ClientId, credential);

            if (authenticationResult == null)
            {
                return View(new EmbedConfig()
                {
                    ErrorMessage = "Authentication Failed."
                });
            }

            var tokenCredentials = new TokenCredentials(authenticationResult.AccessToken, "Bearer");

            // Create a Power BI Client object. It will be used to call Power BI APIs.
            using (var client = new PowerBIClient(new Uri(ApiUrl), tokenCredentials))
            {
                // Get a list of reports.
                var reports = await client.Reports.GetReportsInGroupAsync(GroupId);

                // Get the first report in the group.
                var report = reports.Value.FirstOrDefault();

     

jamesyoung's avatar
jamesyoung
Frequent Visitor
8 years ago

You are mixing the directions for user versus app authentication.  If you plan on the users not having accounts you don't need to pass in or use a clientID and SecretKey.  Here is a code example.  You will just need a username, password and clientID to login.  If you want to opena report and/or dashboard you also need a workspace guid.  Let me know if you have any questions.

 

 

     var credential = new UserPasswordCredential(Username, Password);

            // Authenticate using created credentials
            var authenticationContext = new AuthenticationContext(AuthorityUrl);
            var authenticationResult = await authenticationContext.AcquireTokenAsync(ResourceUrl, ClientId, credential);

            if (authenticationResult == null)
            {
                return View(new EmbedConfig()
                {
                    ErrorMessage = "Authentication Failed."
                });
            }

            var tokenCredentials = new TokenCredentials(authenticationResult.AccessToken, "Bearer");

            // Create a Power BI Client object. It will be used to call Power BI APIs.
            using (var client = new PowerBIClient(new Uri(ApiUrl), tokenCredentials))
            {
                // Get a list of reports.
                var reports = await client.Reports.GetReportsInGroupAsync(GroupId);

                // Get the first report in the group.
                var report = reports.Value.FirstOrDefault();

 

  • Junilo's avatar
    Junilo
    Regular Visitor
    8 years ago

    jamesyoung I tried your snippet below and getting this exception:

     

     

    AdalException: {"error":"invalid_client","error_description":"AADSTS70002: The request body must contain the following parameter: 'client_secret or client_assertion'.\r\nTrace ID: 030b56e4-a488-406d-becc-742e836c1800\r\nCorrelation ID: fb6c997d-5324-4255-ab36-53743bd29c95\r\nTimestamp: 2017-11-13 03:59:19Z","error_codes":[70002],"timestamp":"2017-11-13 03:59:19Z","trace_id":"030b56e4-a488-406d-becc-742e836c1800","correlation_id":"fb6c997d-5324-4255-ab36-53743bd29c95"}: Unknown error

    Here's what I tried:

     

     

     

    static async void GetEmbedToken()
        {

    // took out actual values for these

    var aadUserEmail="";
    var aadPassword = "";
    var groupId = "";
    var clientId = "";
    
            var credential = new UserPasswordCredential(aadUserEmail, aadPassword);

            // Authenticate using created credentials
            var authenticationContext = new AuthenticationContext("https://login.windows.net/common/oauth2/authorize/");
            var authenticationResult = await authenticationContext.AcquireTokenAsync("https://analysis.windows.net/powerbi/api", clientId, credential);

            if (authenticationResult != null)
            {
                var tokenCredentials = new TokenCredentials(authenticationResult.AccessToken, "Bearer");

                // Create a Power BI Client object. It will be used to call Power BI APIs.
                using (var client = new PowerBIClient(new Uri("https://api.powerbi.com/"), tokenCredentials))
                {
                    // Get a list of reports.
    
                    var reports = await client.Reports.GetReportsInGroupAsync(groupId);

                    // Get the first report in the group.
                    var report = reports.Value.FirstOrDefault();
                }
            }
        }

     

     

    • jamesyoung's avatar
      jamesyoung
      Frequent Visitor
      8 years ago

      Junilo

       

      Are you trying to use the App method or the User method to login?  The user method just reuqires you have an account in Power BI and only allows users with Power BI accounts to access the report/dashboard.  The APP login method allows you to share your reports/dashboards with users who do not have a Power BI account but requires setup in Azure.

       

      Jim

      • Junilo's avatar
        Junilo
        Regular Visitor
        8 years ago
        @Jim, I am taking the App Owns Data approach. I have setup app in Azure AD and set permissions. I have created an app workdpace with 1 Power BI Pro user. I already have groupId and a dashboardId. Stuck on that 'Forbidden' exception when trying to generate Embed Token. My Azure AD app is a web-app one. I have read somewhere I need to setup native one?
  • paulsincai's avatar
    paulsincai
    Regular Visitor
    7 years ago

    Everything works fine when authenticating using user + pass but when I'm trying the auth using client secret I get the "unauthorized" message. Hints?

     

    Thx,

    Paul