Custom authentication in PowerBI Desktop - need UniqueId or LocalStorage

[MannyKin]

Hey All,

We're creating an authentication for our custom visual in PowerBI desktop -only- following along with https://community.fabric.microsoft.com/t5/Developer/How-was-authentication-accomplished-in-ArcGIS-Ma....  We're use `this.visualHost.launchUrl` to trigger creation of an token, then polling the backend for the token & storing it via persistParameters.  So far, so good.

The problem though is that parameters are embedded in the pbix file, which means if a file is shared, so is the authentication.  This is less than ideal, and so we are looking at our options for preventing this.

The ideal one appears to be using Local Storage API, however this requires certification, and certification forbids queries to external sources.  (Also, I recieved an 'undeliverable' notification when emailing pbicvsupport@microsoft.com - is that normal?).

Failing this, then the next best option would be to use any kind of identifier that is unique to the PowerBI Desktop installation.  Is there anything present in the info passed to the custom visual that could be used even semi-reliably in this manner?  UniqueId unfortunately is per-instance of the custom visual, and I've yet to turn anything else up that could help.

Any suggestions on where to look for a UniqueID, or any kind of machine-local storage we could use?

[dm-p]

Hi @MannyKin,

There does appear to be an error when emailing the team directly, but emails are getting through (it's probably a group email, and one of the members' addresses is causing an error).

You have correctly surmised that you need your visual to be certified to use the local storage API, so when MS answers your query, they will probably come back with a response along these lines.

Unfortunately, I cannot provide any positive answers to your additional proposals. Visuals in Power BI are essentially considered to be independent of each other and have no more knowledge than they should. The visual instance is taken care of by the main window and not passed to the visual, and anything about Power BI itself might be regarded as identifying information about an installation that a visual should not know about for privacy reasons, so there is nothing unique to hook into here in terms of identifying or distinguishing the visual from others from within the iframe sandbox.

You could generate a UUID internally to your visual, which could serve as "unique enough" and persist as a separate property in tandem with the token property. However, I'm unsure if that would be meaningful to the authenticating system and may not further your requirement.

The newly introduced authentication API is the only official way of handling authentication within visuals. Still, I believe this needs to use MS Entra/Azure AD as the authenticating endpoint. I'm not sure if this would meet your needs. Unfortunately, I have no experience with this API yet, but it could be worth following up with MS via email if you have further questions.

Good luck,

Daniel

[MannyKin]

Hey @dm-p 

Thanks for the time you've taken both on this & on the linked question!  It's been invaluable.

I did get a reply from MS from the email, and they informed me that:
Regarding the Local Storage API, the new version of this API will be launched soon (by the end of February), it will be available for all custom visuals and no specific approvals will be required to use it. You can follow this changelog list to monitor it's release: https://learn.microsoft.com/en-us/power-bi/developer/visuals/changelog

This is great, and it looks like we'll have the tools we need in fairly short order!

(ps - Canterbury?  Go the 'landers 🙂 )