Service Principal Authentication on Web V2 connection type on On-Premises Data Gateway

[rubenespap]

Hi.

I've created a "Web V2" connection on the service (not on On-Premises Data Gateway) using Service Principal authentication and it works - validated through Data Pipeline.

Because I still can't link a DataFlow Gen2 to that type of connection, I then proceeded to recreate it in the On-Premises Data Gateway.

The problem is that when I try to create a "Web V2" connection in the On-Premises Data Gateway, I don't get the option of authenticating it using a Service Principal - only OAuth 2.0, Basic and Anonymous.

My On-Premises Data Gateway is on version 3000.202.16 and release notes for the next and latest version (3000.210.14) doesn't mention this topic.

What am I missing? Can you help?

Thank you!

[rubenespap · Accepted solution]

Conclusion: Unsupported.

As per Microsoft documentation (Azure Data Lake Storage Gen2 - Power Query | Microsoft Learn😞

• The service principal authentication type isn't supported when using an on-premises data gateway or a virtual network (VNet) data gateway.

I've contacted Microsoft Fabric support, who told me there is no ETA for implementing this feature.

[miguel]

What sort of error are you receiving when trying to create the connection in a Dataflow Gen2?

Below is a screenshot of the input fields available to set up the connection to your REST API and the SPN authentication kind while using a Gateway:

[rubenespap]

I'm trying to create the "Web V2" connection at https://admin.powerplatform.microsoft.com/ext/DataGateways, not in the Dataflow Gen2 "Get data" option.

Is "Web API" (on Dataflow Gen2 Get data) the same as "Web V2" (on the Power Platform Admin)?

Assuming a positive answer, where do I in Dataflow Gen2 "Get data" option with Service Principal configure the "Token Audience Uri" (the API permission GUID from App Registration)?

I ask because when I try to create a "Web API" on Dataflow Gen2 "Get data" option with Service Principal and do not provide the "Token Audience Uri" I get the following error:

Unexpected error (Session ID: cc68f043-46fa-42e5-b120-bfe6d9098440, Region: europe)

In the same way, if I try to create a "Web V2" as a "Cloud" connection with Service Principal on the Power Platform Admin and don't provide the "Token Audience Uri" i get the following error:

Unable to create connection for the following reason: Failed to login with OAuth token, please update the credential manually and retry.

Details:

Please have this information handy if you choose to create a support ticket.

Session Id: xxxxxxxx-1048-4701-9872-75dc40e1ab43
RequestId: xxxxxxxx-6bb4-411d-99e4-ad40d3dce62d
Cluster URI: https://api.powerbi.com
Status code: 400
Time: Tue Mar 12 2024 xx:xx:xx GMT+0000 (Western European Standard Time)

If I provide the "Token Audience Uri" it works.

[miguel]

The link that you've shared for  https://admin.powerplatform.microsoft.com/ext/DataGateways is exclusively to be used with the PowerPlatform dataflows. Not the Fabric nor the Power BI Dataflows. They do not share the same credential storages.

The correct url to use in Fabric would be --> https://app.powerbi.com/groups/me/gateways 

Nevertheless, if you are planning to use a connection inside of Dataflow Gen2 then we recommend creating the connection inside of Dataflow Gen2.

If what you're trying to do is create a connection for a Web activity in Data Pipeline, then please let us know. Web V2 is only for Data Pipelines.

[rubenespap]

I've tried to create the connection in the On-Premises Gateway via:

• https://admin.powerplatform.microsoft.com/ext/DataGateways, both as a "Web" and as "Web V2";
• https://app.powerbi.com/groups/me/gateways, both as a "Web" and as "Web V2";
• Directly on Dataflow Gen2 "Get data" option, both as "Web Page" and as "Web API".

In all those cases I wasn't presented the option of Service Principal authentication.

Isn't Service Principal authentication supported when I use an On-Premises Gateway?

[Element115]

If I understand you correctly, I had a somewhat similar issue when, after a report got published, even I, the creator, couldn't access it, because the Service was asking me to authenticate to the underlying datasource, which is a lakehouse.  The only thing that worked was OAuth 2.0.  FYI, the source is an on-prem DB and the data passes through 2 DFg2s (one for extract, the other for load into the lakehouse), and finally the report connects to the lakehouse using the lakehouse SQL analytics endpoint. The report is created using PBI Desktop and not PBI Service.

[rubenespap]

My problem happens before adding Dataflows Gen2 or Data Pipelines to the mix. It's while creating the "Connection" - before reporting and even before data loading.

So... I'm afraid I haven't explained myself well enough. 🙄

I'll try again.

To access data from the Fabric Service (or Power BI Service, or Power Platform) in an enterprise environment we need at least one "Connection" configured, that must be configured either through "On-Premises" (using a Power BI Gateway), "Virtual Network" or "Cloud" (directly on the service) - quotes are Microsoft's own terms.

Those connections can be "SQL Server", "Azure SQL Server", "Oracle", "OData", "SharePoint", "Web" or "Web V2", to name just a few.

My data source is a REST service that's behind Service Principal authentication.

So I've created a "Web V2" connection on "Cloud" and that has Service Principal as an option. I've tested it with Data Pipeline and it works. Next step was to use it through Dataflows Gen2.

Problem #1: Dataflows Gen2 doesn't (yet?) support "Cloud" connections.

Problem #2: When I tried to recreate that same connection "On-Premises", Service Principal authentication is not an option.

And here I am.

I hope it's clear now.

[Element115]

Yes,  thank you. It's clear now.  With the on-prem connection, have you tried authenticating using OAuth 2.0? And if yes, what result did you get?

[rubenespap]

I have tried, but OAuth 2.0 forces an Azure authentication which doesn't accept the Service Principal ("App Registration") authentication scheme - and that particular REST service only accepts Service Principal authentication.