Unable to clear permissions - known bug? - sparse authentication logs

[ponga]

I'm trying to connect to a REST datasource using an M query, where the REST source requires a POST to obtain a session key (stored in a cookie), and thereafter GET requests to obtain the data with the cookie set. While there are likely problems with the M code below, the initial Web.Contents()/POST fails to execute (when I strip the query down), with an error stating that authentication fails.  The REST API documentation states that anonymous authentication should be used.

I therefore have tried to remove all authentication information. However, the remaining http://<arisserverURL>/ data source stubbornly refuses to disappear when I try to clear permissions, either for it, or for all; likewise, the full URL's including the relative paths turn up on the Global permissions, and likewise refuse to be removed. Is this a known bug?

let
ArisDatabaseURL = "http://<arisserverURL>/",
KeyRequest = Json.FromValue([tenant="default", name="system", password="*******"]),
KeyResponse = Web.Contents(ArisDatabaseURL, [RelativePath="umc/api/v2/tokens", Content=KeyRequest]),
KeyDoc = Json.Document(KeyResponse),
ApiKey = KeyDoc{0}[token],
Cookies = "accesstoken=" & ApiKey,
Databases = Web.Contents(ArisDatabaseURL, [RelativePath="abs/databases", Headers = [Cookie = "accesstoken=" & Cookies]] )
in
Databases

Also, is there any way of getting more authentication information than from the trace information in the PBIDesktop logs? All I'm seeing is logs from DataMashup.Trace with records like the below, which tells me little of what my server is actually saying. The API works through POSTMAN, but getting the requests done from PowerBI has proven challenging.

["Formula","Section1/Fr%C3%A5ga1/KeyRequest"],
[21,1,true,true,
[["AnalysisStartedAt","2023-01-03T14:27:07.5060695Z"],["Preview","a02b27ac-5dbf-4102-b387-4b89bb56bc31"],["PreviewFinishedAt","2023-01-03T14:27:07.8380440Z"],["CultureUsed","1"],["Firewall","57073ffb-98e9-4f59-bc38-2e478f5910f3"],["Resources","544f5b57-5e8a-47f8-934b-38b8586cefda"]],[],[]],

[v-yangliu-msft]

Hi  @ponga ,

Based on your requirement description, it seems that you want to connect directly to an official PBI Rest API via M code in Power Query, right? If so, it does only support connecting in anyonmous mode, and the only way to give a token is to dynamically generate an AAD token through a function and place the dynamically generated AAD token in your connection to an official PBI Rest API via M code to be called each time the data is refreshed. For details, you can see this example where I connected to the official PBI Rest through this method "https://api.powerbi.com/v1.0/myorg/admin/activityevents”

()=>
let
    body = "grant_type=client_credentials&scope=openid&resource=https://analysis.windows.net/powerbi/api&client_id=xxx&client_secret=xxx",
    Data = Json.Document(Web.Contents("https://login.microsoftonline.com/xxx/oauth2/token",[Headers = [#"Content-Type"="application/x-www-form-urlencoded"],  Content=Text.ToBinary(body)])),
    access_token = Data[access_token]
in
    access_token
let
    Query1 = let
    Source = Web.Contents("https://api.powerbi.com/v1.0/myorg/admin/activityevents?startDateTime='2022-11-13T07:55:00.000Z'&endDateTime='2022-11-13T17:55:00.000Z'",
            [
            Headers = [Authorization="Bearer " & Authorization()]
        ])
in
    Json.Document(Source),
    activityEventEntities = Query1[activityEventEntities],
    #"Converted to Table" = Table.FromList(activityEventEntities, Splitter.SplitByNothing(), null, null, ExtraValues.Error),
    #"Expanded Column1" = Table.ExpandRecordColumn(#"Converted to Table", "Column1", {"Id", "RecordType", "CreationTime", "Operation", "OrganizationId", "UserType", "UserKey", "Workload", "UserId", "ClientIP", "UserAgent", "Activity", "ItemName", "WorkSpaceName", "DatasetName", "ReportName", "CapacityId", "CapacityName", "WorkspaceId", "ObjectId", "DatasetId", "ReportId", "ArtifactId", "ArtifactName", "IsSuccess", "ReportType", "RequestId", "ActivityId", "DistributionMethod", "ConsumptionMethod", "ArtifactKind", "HasFullReportAttachment"}, {"Column1.Id", "Column1.RecordType", "Column1.CreationTime", "Column1.Operation", "Column1.OrganizationId", "Column1.UserType", "Column1.UserKey", "Column1.Workload", "Column1.UserId", "Column1.ClientIP", "Column1.UserAgent", "Column1.Activity", "Column1.ItemName", "Column1.WorkSpaceName", "Column1.DatasetName", "Column1.ReportName", "Column1.CapacityId", "Column1.CapacityName", "Column1.WorkspaceId", "Column1.ObjectId", "Column1.DatasetId", "Column1.ReportId", "Column1.ArtifactId", "Column1.ArtifactName", "Column1.IsSuccess", "Column1.ReportType", "Column1.RequestId", "Column1.ActivityId", "Column1.DistributionMethod", "Column1.ConsumptionMethod", "Column1.ArtifactKind", "Column1.HasFullReportAttachment"})
in
    #"Expanded Column1"

The AAD token can be tested here by calling.

Best Regards,

Liu Yang

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[ponga]

Thanks: my question is actually about contacting an external REST service requiring an access token. I simply can't make my M solution replicate my PostMan sequence of interactions, and am not getting a lot of information on my authentication error.  Right now, I might need to go the WireShark route or dive into Apache server side logs, neither of which are particulary tempting or easy.

But I'll see if your code might offer hints as to different ways of dealing with cached tokens or whatever is actually messing up my calls.