Forum Discussion

girishtharwani2's avatar
girishtharwani2
Icon for Helper III rankHelper III
1 year ago
Solved

Azure Keyvault integration to Fabric Data Factory

I am looking for a way to integrate Azure Key Vault into Fabric Data Factory pipelines. Unfortunately, I haven't had any success so far. Any suggestions on how to achieve this integration?   Thanks...
General Question
Pipeline
  • NandanHegde's avatar
    NandanHegde
    1 year ago

    When you state integration of Key vault in fabric data pipelines, can you please state whether it is in the ocnnections or within the pipeline?

    Unfortunately, KV integration within connections is not available as of today.

     

    Within pipelines, you can use web activity and KV rest API to get the secert values

  • Anonymous's avatar
    Anonymous
    1 year ago

    Hi girishtharwani2 ,

    I wanted to follow up since we haven't heard back from you regarding our last response. We hope your issue has been resolved.
    If the community member's answer your query, please mark it as "Accept as Solution" and select "Yes" if it was helpful.
    If you need any further assistance, feel free to reach out.

    Thank you,
    Pavan.

Anonymous's avatar
Anonymous
Not applicable
1 year ago
 
Thanks for reaching out in Microsoft Community Forum
 
Key Vault integration with Fabric data factory is not available but within pipelines you can use webactivity and key vault REST API to get secret values
 
To retrieve secret values from Azure Key Vault within a Fabric Data Factory pipeline using Web Activity and Key Vault REST API, follow these steps:
 
Step 1: Grant Permissions to Access Key Vault
Go to the Azure portal and navigate to your Azure Key Vault.
Assign appropriate permissions
 
step 2; If using Managed Identity, ensure the Fabric Data Factory's Managed Identity has Get access on secrets.
If using Service Principal, grant similar permissions to the Service Principal.
 
step 3; Obtain the Key Vault REST API URL
The base URL for Key Vault REST API is: https://<YourKeyVaultName>.vault.azure.net/
To access a specific secret, append the secret name: https://<YourKeyVaultName>.vault.azure.net/secrets/<SecretName>?api-version=7.3
 
step 4; Configure Web Activity in Fabric Data Factory
 
URL: Enter the Key Vault secret URL (https://<YourKeyVaultName>.vault.azure.net/secrets/<SecretName>?api-version=7.3).
Method: Set to GET.
Authentication:
For Managed Identity:
Select the Managed Identity option.
Ensure the Managed Identity has access to the Key Vault.
For Service Principal:
Obtain an Access Token from Azure AD and pass it in the Authorization header.
 
Add a header with the following key-value pair: Authorization: Bearer <AccessToken>
Step 5: Get an Access Token (If Using Service Principal)
Add a separate Web Activity to retrieve an Azure AD token using the OAuth 2.0 token endpoint:
 
URL: https://login.microsoftonline.com/<TenantID>/oauth2/v2.0/token
Method: POST
Body:
{
  "grant_type": "client_credentials",
  "client_id": "<ServicePrincipalClientID>",
  "client_secret": "<ServicePrincipalSecret>",
}
Headers:
Content-Type: application/x-www-form-urlencoded
 
5.Capture the token response in the output of this activity.
 
6. Link Access Token to Key Vault Web Activity
In the Key Vault Web Activity, use the output of the token retrieval activity for the Authorization header:
Use dynamic content to reference the token: @concat('Bearer ', activity('GetTokenActivityName').output.access_token)
 
7. Use Retrieved Secret Value
The Key Vault API returns the secret value in the value property of the JSON response.
Pass this output dynamically to subsequent pipeline activities: @activity('GetSecretActivityName').output.value
 
If you found this post helpful, please consider marking it as "Accept as Solution" to help other members find it more easily.
 
 Thanks,
 Pavan.
  • GarryH's avatar
    GarryH
    New Member
    1 year ago

    What do you do if it is ServicePrincipalSecret that you are trying to retrieve from the key vault?

  • ToddChitt's avatar
    ToddChitt
    Icon for Super User rankSuper User
    1 year ago

    Hello Anonymous 

    I came across this post while trying to get a Fabric Pipeline Web activity to connect to an Azure Key Vault and retireve a Secret Value. I am having trouble:

    You state: "step 2; If using Managed Identity, ensure the Fabric Data Factory's Managed Identity has Get access on secrets.

    If using Service Principal, grant similar permissions to the Service Principal."
     
    Fabric Data Factory's Managed Identity? Where is that? Is that the Workspace Identity from Workspace Settings? 
     
    For step 4, you state that for Managed Identity...
    But that is not an option in Web Activity's Connection Properties. For Authentication Kind, I see: Anonymous, Basic, and Service principle.
     
    What am I missing?