Forum Discussion
Service principal authentication for Web Connection throws OAuth error
Hi,
I'm trying to replicate the ADF pipeline from this blog which involves connecting to the Power BI/Fabric Admin API (https://api.powerbi.com/v1.0/myorg/admin/). I'm following this documentation to create a Web connection but the connection fails with the error below. It's not clear to me why the error references OAuth when I'm trying to use a service principal.
I did notice that when creating a REST linked service in ADF, you have to specify the AAD resource (AAD resource: https://analysis.windows.net/powerbi/api), but that is does not seem possible in Fabric (yet). Perhaps that's the cause of error?
Thanks!
This issue is resolved as the Web V2 connection now allows for service principal auth. For those wondering, the "Token Audience URI" is the same thing as the "AAD Resource" and in this scenario, https://analysis.windows.net/powerbi/api is the correct value for that parameter.
12 Replies
Hi,
You mentioned you are using a service principal. Did you give the service principal the permissions on power bi to access the API's ?Kind Regards,
Dennes
Yes I should have mentioned that. I have successfully used the service principal to access that specific API using a Spark notebook. I tried the credentials multiple times to make sure it wasn't a copy/paste error when creating the web connection.
Hi,
I also notice your screenshot of the new connection window doesn't make very clear where the service principal is set on the connection.
Kind Regards,
DennesHere is the complete screenshot:
Hi jihool3670,
Have you found a solution to your problem, as I have exactly the same problem?
Thanks in Advance,
Charline
Hi Charline - No, not yet. It seems to be a limitation of the copy activity authentication options in Fabric at the moment.
makromer can you confirm Fabric pipelines can't authenticate to the Fabric/Power BI admin API at this point in time?
Hi , Are you trying to use Web Activity? if yes web activity works with Web V2 Connection, pls try use that, you will see option for Token Audience
Thanks for the suggestion!
I am able to successfully create a Web V2 connection and I am able to select that connection in both the Web and Webhook activities in a Fabric pipeline.
However, I want to use the Copy Activity rather than the Web activity. When I add a Copy Activity to the canvas, I don't see my newly created V2 web connection as an option in the Source connection drop down, even after refreshing the list of the connections.
Additionally, when I try to create a new connection from within the Copy Acitivity, boththe REST and HTTP connections only have Anonymous and Basic as their authentication options and don't include service principal authentication.
It seems like this is just a current limitation of the Copy Activity at this point in time but I haven't been able to any documentation around current limitations so I'd love confirmation (and ideally a sense of when to expect this functionality).
I was about to log a ticket but see that jihool3670 had the exact same issue a year ago. Has anyone had success in getting this to work?
For the past year I have been retrieving Power BI Audit from the Power BI Activity log using Power BI Managememnt cmdlets for Powershell. I ran a Powershell script that that retrieved a days worth of Audit data to a json file and then ran an SSIS package to move the data to an SQL Server database.
Our organization now has MS Fabric. I want to utilize the features and update the process to using MS Fabric Data Factory to retrieve Power BI Activity data and move it to a database.
I had a service principal created and added it to an Azure AD group. In the Power BI tenant settings, I then enabled permissions to this group for "Service principals can use Fabric APIs". I am trying to follow the instructions from this blog and following this documentation. The exact same scenario as jihool3670.
I tried creating a connection using Web as the connection type and Service Principal as the Authentication method. I used "https://api.powerbi.com/v1.0/myorg/admin/" as the base URL. Creation fails with the same message originally posted "Unable to create connection for the following resaon: Failed to login with OAuth token, please update the credential manually and retry."
With the base URL I left myorg as is. Should I have replaced it with something else?
I have also tried creating a web2 connection and it fails with the same message. I left "Token Audience Uri" blank as I do not know what it is and could not find it anywhere or where to find it.
How could I get this working? Can this be done in MS Fabric? If not, has anyone got this working in Azure Data Factory using a Linked Service?
This issue is resolved as the Web V2 connection now allows for service principal auth. For those wondering, the "Token Audience URI" is the same thing as the "AAD Resource" and in this scenario, https://analysis.windows.net/powerbi/api is the correct value for that parameter.
