Forum Discussion

abshirey's avatar
abshirey
Microsoft Employee
6 years ago

OAuth2 Data Connector with PKCE

Hi, I'm trying to implement a custom OAuth2 data connector with PKCE to call a rest api, so I do not have to use confidential client secrets in the report. However, I can't get the authorization to v...
Need Help
v-juanli-msft's avatar
v-juanli-msft
Community Support
6 years ago

Hi abshirey 

Are the references below helpful?

https://docs.microsoft.com/en-us/power-query/handlingauthentication

Power Query extensions are evaluated in applications running on client machines.

Data Connectors should not use confidential secrets in their OAuth flows, as users may inspect the extension or network traffic to learn the secret.

See the Proof Key for Code Exchange by OAuth Public Clients RFC (also known as PKCE) for further details on providing flows that don't rely on shared secrets.

 

Best Regards
Maggie
Community Support Team _ Maggie Li
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

 

 

ccc

neil_varnas_IP's avatar
neil_varnas_IP
Advocate I
6 years ago

Hi v-juanli-msft , abshirey 

I'm working through the implementation of PKCE authentication flow for our certified connector and wondered if you could assist with a few questions I have:

  1. The flow works fine when using code_challenge_method with a value plain. However, this is not the recommended method and hashing the verification code is highly advised (in addition to a few other things, see formula below)
    BASE64URL-ENCODE(SHA256(ASCII(code_verifier)))
    Does M language (Power Query) has an out-of-the-box function to do the hashing?
  2. What is the best way to store code verifier value for the user session? As far as I can see if one assigns a value to a variable it persists for the OAuth flow but when it comes to refreshing the access token a new value is used. Please advice on best practice. 

Thanks

  • abshirey's avatar
    abshirey
    Microsoft Employee
    6 years ago

    Hi neil_varnas_IP 

     

    As far as I know, there isn't a sha_256 method in the M language. If you wanted to use this code_challenge_method, maybe you could generate the code_challenge with a Python script in Power BI, set the output as a env variables and reference them in the connector? This is a random suggestion, I haven't researched if this is possible.

     

    I used the plain code_challenge method and created the code_verifier and code_challenge in the StartLogin method by concatenating two guids together: Text.NewGuid() + Text.NewGuid(). I got this idea from the GitHub post: https://github.com/microsoft/DataConnectors/issues/280#issuecomment-589651327 . It also shows how to pass it in as an optional fourth parameter to the TokenMethod so you can still use the refresh method. 

     

    Hope that helps! If you decide to use the plain method with guids and have any implementation issues, let me know

    • neil_varnas_IP's avatar
      neil_varnas_IP
      Advocate I
      6 years ago

      Hi abshirey ,

       

      Thanks for your quick response. That link was a massive help to get the verification code passed around. Re S256 hashing, I keep it a plain code just now, hopefully, in the future we'll get some additional helper functions to get it the value hashed and make it more secure. 
      Thanks