Access to abc.corp.ad.abcd.com is denied, resolved IP address is 172.1.2.3

[dbeavon3]

Trying to call a REST api via a pipeline copy activity and getting a meaningless error like so:
Access to abc.corp.ad.abcd.com is denied, resolved IP address is 172.1.2.3 , network type is OnPremise

Is there an English translation for this message?

I am able to find a log file in the gateway directory like so:

IntegrationRuntimeErrors20241212.000000000.log

.. but it provides little additional help:

jobId: 00000000-0000-0000-0000-000000000000
activityId: 3e56456c-1189-4da0-8351-e8592955896c
eventId: QueryRuntimeTestConnectionV2Exception
message: TestConnection failed, error message: 'Type=Microsoft.DataTransfer.Common.Shared.HybridDeliveryException

Still need an English translation for this message.  There is some sort of validation that is failing in a stack ... at "Microsoft.DataTransfer.SecurityValidation.HostValidator.IsAllowedHost".

Why can't Power BI give me better error message, when the problems are totally self-inflicted?  This is a very painful platform to work with.  Everything is supposed to be "easy" (low-code) but the proprietary platform and meaningless error messages are counterproductive to actually getting anything accomplished.

I'm assuming the "HostValidator" is configurable, but it isn't coming up in any google searches.  Any pointers would be appreciated.

[dbeavon3]

From what I can gather, Microsoft forgot to include a program called "dmgcmd.exe" in the on-prem gateway installation for Power BI.  Can someone confirm?

This so-called "dmgcmd.exe" is a data factory component that configures the "HostValidator" rules from what I can tell.  It appears there is some sort of an arbitrary restriction on connecting to a REST api endpoint that runs on the same machine as the gateway.  In order to remove the restriction you need to be able to run "dmgcmd.exe" with the option -EnableLocalMachineAccess.

I am going to try to open a ticket with this (Mintree-ADF) team at Fabric and see if they agree with the theory.  If anyone knows about dmgcmd.exe, or how to accomplish a comparable task on a Fabric gateway, please let me know.

[v-xianjtan-msft]

Hi @dbeavon3 

It's a great option to open a ticket. A dedicated Microsoft engineer will investigate the problem for you and provide more specialized advice. It would be great if you could come back here and share the solution once you have it.

Best Regards,
Jarvis Tang
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[dbeavon3]

@v-xianjtan-msft Are you aware of the ADF-IR config tool ("dmgcmd.exe")?

Any thoughts on what the corresponding alternative would be for the PBI version of the gateway?

I'm guessing there is no alternative, and that Microsoft didn't introduce a solution for this scenario on the Power BI side of things.    We often run into a lot of undocumented issues on Fabric.  It is especially troublesome when we face new and unexpected issues on Fabric, that we had not faced on ADF or Synapse.

[dbeavon3]

As of now, the PG seems to already have an IcM since the issue was reported by several other customers. 

Despite the fact that this is a common pitfall, the PG seems willing to let everyone stumble into it.  They are delaying any public communication, perhaps until February...  It seems to be the MO in Fabric to allow dozens of customers trip over the same issues, before we get any relief.   I suspect this issue has already been well-known for weeks or months.

The PG claim, as-of now, is that this incompatibility was put in place by design for "security reasons" (of course).  Yet this was not a security issue in the context of the SHIR.  

At the end of my case, I'm hoping there will be some config file or registry key that can be edited.  There should be a way to circumvent these unusual and confusing errors in the OPDG of Fabric.

[dbeavon3]

It is probably the fastest turn-around I've ever seen in Microsoft docs.  They added a "known issue" for this error message in the Fabric pipelines:

Known issue - Local data access isn't allowed for pipeline using on-premises data gateway - Microsof...

https://learn.microsoft.com/en-us/fabric/get-started/known-issues/known-issue-989-local-data-not-all...

... the reason this was so problematic is because the ADF self-hosted IR was more flexible, and customers don't expect there to be a downgrade when moving over to Fabric.  As such the issue has the appearance of a "bug".  

Microsoft portrays this change as a security enhancement.  I will let others decide whether or not it is an enhancement.  I suppose that removing software features & software flexibility will always be considered more "secure" than adding software features.

While this documentation was added in three weeks, it is doubtful that I will be able to make that happen next time.  A high-level PM had contacted me about some complaints I made on reddit, and it was only with his help that we were able to make haste with these docs.  I guess it is true that the squeekiest wheels get the grease. 😉