Forum Discussion

abshirey's avatar
abshirey
Microsoft Employee
6 years ago

OAuth2 Data Connector with PKCE

Hi, I'm trying to implement a custom OAuth2 data connector with PKCE to call a rest api, so I do not have to use confidential client secrets in the report. However, I can't get the authorization to v...
Need Help
v-juanli-msft's avatar
v-juanli-msft
Community Support
6 years ago

Hi abshirey 

Are the references below helpful?

https://docs.microsoft.com/en-us/power-query/handlingauthentication

Power Query extensions are evaluated in applications running on client machines.

Data Connectors should not use confidential secrets in their OAuth flows, as users may inspect the extension or network traffic to learn the secret.

See the Proof Key for Code Exchange by OAuth Public Clients RFC (also known as PKCE) for further details on providing flows that don't rely on shared secrets.

 

Best Regards
Maggie
Community Support Team _ Maggie Li
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

 

 

ccc

neil_varnas_IP's avatar
neil_varnas_IP
Advocate I
6 years ago

Hi v-juanli-msft , abshirey 

I'm working through the implementation of PKCE authentication flow for our certified connector and wondered if you could assist with a few questions I have:

  1. The flow works fine when using code_challenge_method with a value plain. However, this is not the recommended method and hashing the verification code is highly advised (in addition to a few other things, see formula below)
    BASE64URL-ENCODE(SHA256(ASCII(code_verifier)))
    Does M language (Power Query) has an out-of-the-box function to do the hashing?
  2. What is the best way to store code verifier value for the user session? As far as I can see if one assigns a value to a variable it persists for the OAuth flow but when it comes to refreshing the access token a new value is used. Please advice on best practice. 

Thanks