Forum Discussion
Advocate IExtracting the Username being used in a Gateway Data Source
I beleive there is a way to replace the credential being used by a Data Source on a gateway, but I haven't dug into doing that yet..
At the moment, I would just like to be able to ask a Data Source what Username it is using to authenticate to the actual database.
I prefer to do most things via PowerShell, but can grumpily use other methods if I need to.
Using Get-DataGatewayDatasource, I can get these properties, but Credentials is always NULL:
CredentialType
EncryptedConnection
PrivacyLevel
EncryptionAlgorithm
Credentials
UseCallerAADIdentity
UseEndUserOAuth2Credentials
UseCustomOAuthApp
SkipTestConnection
IsCredentialEncrypted
I can undersatnd if this is not possible to do, because it would seem like a potential information leak if it was possible, but I haven't been able to find anything confirming that it is not possible to ever see the username after it has been entered.
8 Replies
SaiTejaTalasilaSuper User
Hi,
As far as I know:
You are not supposed to provide gateway access to everyone. You should provide access to the connections. Your password won't be exposed to anyone once the connection is created, and most data sources will lock your account on the database if you enter the wrong password more than three times.So,the rest API command will work only if they have access to that gateway connection.- JMLyle
Right, we typically provide gateway acces to no one, but add people as user of specific Data Sources that they need.
My struggle is that security would like to do a review of what a Data Source provides someone with access to. As a Gateway admin I can easily determine the connection details, but then the DBA would like to know what account is being used to access the database so that they can provide details about what data/tables/etc it is able to access.
- JMLyle
Yeah, agreed, it probably shouldn't be possible, but it sure would help me do a few things if it was possible.
I imagine that someone here either has been able to do it, or can point to a place where Microsoft says that you can't.
A prompt would be handy though, perhaps the first or last character exposed. There can be so many systems/usernames in a large org and when a connection goes offline, it would be handy to have a hint at least which username was used. Alternatively, you can keep a list of usernames used for what connection, but that really defeats the purpose of security right?
- Wikkleyn_81
JMLyle There is no way to get the credentials used to create the gateway connection. There is an idea raised for this and all votes help.
https://ideas.fabric.microsoft.com/ideas/idea/?ideaid=465aea7f-b208-494b-8155-26faeaa21af7
Here is teh technote on teh encryption.
https://learn.microsoft.com/en-us/power-bi/connect-data/service-gateway-data-sources#store-encrypted-credentials-in-the-cloud
You can use the Power BI Rest API to update the credentials using PowerShell:Gateways - Update Datasource
https://learn.microsoft.com/en-us/rest/api/power-bi/gateways/update-datasource
luke-novacekHelper I
As far as I know the documented APIs still do not return it:
- Get-DataGatewayClusterDatasource gives no credentials
- the Fabric connections API returns only the credential type
The portal reads the username from an endpoint of its own. GatewayLens, a free, open-source console I built for gateway admins, reads it the same way - so it lists the account behind every connection you can see, and you can filter by it: every connection that signs in as one service account. That endpoint is not documented, so it is a checkbox you can turn off. GatewayLens on GitHub
