Unanswered

How long a on-premise data source connection expire?

(0) Share

Report

Posted on by Community Power Pla... Microsoft Employee

I have setup an on-premise data gateway. In my PowerApp I have established connection to SharePoint 2019 on-premise. When the tester first time open the app, the app asked him type in his on-premise AD login/password. After that tester is able to open the app with correct data source. Next time when he open the app again he doesn't need to type in login/password.

My questions are:

1. Will the saved credential keep forever or it will be expired after a period?

2. We reset his on-premise AD password. But he can still open the app without issue. How long the saved session will be expired?

Categories:

Governance & administering

All responses (9)

Answers (0)

Sort by

EricRegnier 8,720 Most Valuable Professional on at

Like
a
(0)

Report
Copy link

Link copied!

Hi @Anonymous,

The gateway should be configured with a service account and not a personal account. The password for a service account should never expire and not have MFA enabled. More info: https://docs.microsoft.com/data-integration/gateway/service-gateway-app
That said, to answer your 2 questions:
1) should keep forever
2) Will have issue and would need to always change the pw

Hope this helps!
Community Power Pla... Microsoft Employee on at

Like
a
(0)

Report
Copy link

Link copied!

Dear Eric,

Thanks for your response. In my environment, I setup my gateway using a service account as MS suggested. However there is no article talk after the user experience.

In my test, after publish my PowerApps with SP2019 as data source, when user open the app first time he or she will see below screen.
Then user need to provide an on-premise AD login here. They input their user account (not service account) and then they can open the app successfully.

For test purpose, we reset the users' AD password afterward. Those users can still open the app and no error at all.

Is it expected behavior? Should we provide a service account for those users instead of using their own AD account?
EricRegnier 8,720 Most Valuable Professional on at

Like
a
(0)

Report
Copy link

Link copied!

Yes, this is an expected behavior as the app will act on behalf of the current user, so that shouldn't be a service account. Similar to how an app would connect to Dataverse or OneDrive with as the current user.
Community Power Pla... Microsoft Employee on at

Like
a
(0)

Report
Copy link

Link copied!

I see. Since it is expected behavior I have to accept it. Maybe some user education is required.

Just want to point out to Microsoft current behavior is unacceptable. If user's password is expired, users should be alerted with accurate error message.
EricRegnier 8,720 Most Valuable Professional on at

Like
a
(0)

Report
Copy link

Link copied!

Yes, if users password expires or changes the they will be prompt again to re-authenticate. Not the best but not a bad experience also.
Community Power Pla... Microsoft Employee on at

Like
a
(0)

Report
Copy link

Link copied!

Hi Eric, my test is completely different with yours.

In my test, after password changed, users do not get any prompt or error. They can still open the same app without retype the password. However they do not see any data in the App.

It would be great if PowerApp prompt again to re-authenticate but it doesn't.
EricRegnier 8,720 Most Valuable Professional on at

Like
a
(0)

Report
Copy link

Link copied!

I also did the same test with the Office365 connector and Common Data Service connector and user can still open the app and can retrieve the results. I guess the token is saved and reused... When that expires Power Apps should prompt to re-authenticate. How long does that token last? Not sure... It's weird that you can't see data though. Suggest to open a Microsoft Support ticket at https://admin.powerplatform.microsoft.com/support to get more clarity on this and about your issue that data is not displayed.

Keep us posted 🙂
Community Power Pla... Microsoft Employee on at

Like
a
(0)

Report
Copy link

Link copied!

After some discussion with Support team here is their reply:
Microsoft support team confirmed as "there is no validation when they are connecting to SharePoint since it is the first party APIs will automatically log in with their already logged canvas app credential."

I think it means development team assume users on the world login their on-premise SharePoint using Azure AD account, not their on-premise AD account.

In other word, it is by design.
EricRegnier 8,720 Most Valuable Professional on at

Like
a
(0)

Report
Copy link

Link copied!

Cheers for the update. Not sure I fully understand the response though... If we take Dataverse/CDS as an example instead of on-prem SharePoint, how long does that token last if the connection was made with another account other than the current logged in user?