Answered

Implicitly Sharing Custom Connectors in PowerApps

(0) Share

Report

Posted on by Christoph_G

Hello everyne,

I have already built a custom connector using basic authentication and it works fine (technically).

The only issue I am facing is that every user which opens the App has to enter the credentials for the basic authentication (of the data source) of the custom connector by his/her own which is not feasible in my scenario as normal users do not know the credentials they have to enter.

Is there a way to pass the credentials directly to the data source in a custom connector or to "share the connection" (connector+credentials) instead of the connector alone along with the app.
I would like this to work like the SQL-Server-Connection which is also "implicitly" shared along with the powerapp without the need of having end users enter any credentials for the SQL-Server.

Thank you in advance for your support and ideas 🙂

Categories:

Building Power Apps

All responses (10)

Answers (1)

Sort by

v-yuxima-msft Microsoft Employee on at

Like
a
(0)

Report
Copy link

Link copied!

hI @Christoph_G

How do you create your customer connector?

I test with this, and the Authentication type I choose as no authentication,when I share the app, there is no need to fill credentials, and user can use it directly.

And more information:

register-custom-api

https://powerusers.microsoft.com/t5/General-Discussion/How-exactly-does-sharing-an-app-with-connectors-work/td-p/175748

Hope this could be helpful.

Best Regards.

Yumia
Christoph_G 62 on at

Like
a
(0)

Report
Copy link

Link copied!

Hi @v-yuxima-msft ,

thank you for your quick reply.

When i choose no authentication I get a 401 (Unauthorized) since the API i am talking to needs basic authentication credentials in order to "let me in".

I was really asking if it is possible to pass on the credentials within the connector (definition) so that a powerapps-api-call via the custom connector always uses those credentials without end users ever having to enter them.

I hope it is understandable what I am trying to say 😄

Thank you and kind regards
Christoph
alaugMSFT Microsoft Employee on at

Like
a
(1)

Report
Copy link

Link copied!

Hi, @Christoph_G.

When you a create a custom connector configured with an authentication type of generic Oauth 2.0, Oauth 2.0 for specific services or Basic authentication, by default the PowerApp user will be prompted to provide credentials so the app can create a connection.

A custom connector with authentication type 'API Key' won't prompt the end user for credentials. The authentication details are specified when creating an app that uses this type of connector, when the app is shared the connection already exists and end users won't be prompted for creds.

The authentication types that can be defined in a custom connector are outlined here.

Also, an easy way to confirm if a connection is automatically shared with app users is outlined here.

Lastly, there is one more alternative to the info above, when you create a connection for your app using basic auth you can share the connection with the same users the app is shared with. Note, basic auth connections are not implicitly shared with users when an app is shared with them. For instance, go to https://make.powerapps.com > Data > Connections > Select the connection you created for the app to be shared > In the details pane of the connection there is a 'share' button.
Christoph_G 62 on at

Like
a
(0)

Report
Copy link

Link copied!

Hello @alaugMSFT;

you are writing that with OAuth2.0 and Basic, users are "by default" prompted to enter credentials so that the app can create a connection.
Is there a way to bypass that with basic authentication? I have to use basic authentication.

Authentication Type "API KEY" is unfortunately not available since I connect via onPremises Data Gateway.
As soon as this Gateway-Checkbox is checked I only have "Windows" and "Basic", whereas I as already said have to use basic for the connector to work.

Lastly a question to your last paragraph:
I looked inside my Connections (of the Custom Connector) and they are shareable.
So If I share the Connection (NOT the connector) with Users before I share the App with them they won't be prompted to enter their own credentials in basic?

Thank you and kind regards
Christoph
Verified answer

alaugMSFT Microsoft Employee on at

Like
a
(2)

Report
Copy link

Link copied!

Correct, the only way to preempt the user authentication is by sharing a connection with them (so the user won't have to auth to create a new connection).
artem1313 8 on at

Like
a
(0)

Report
Copy link

Link copied!

Is it still true? I have created PowerApps that is using custom connectors and use Basic token to authenticate. I just talked to someone at MS support and they told me that users of PowerApp will have to authenticate the first time, even if I share connectors with them. Please let me know.
Community Power Pla... Microsoft Employee on at

Like
a
(4)

Report
Copy link

Link copied!

Hi!

You can also use policies to achieve this. Set Authentication type to No authentication on the Security tab and create a new Policy on the Definition tab with the following settings:

Name: Any name here, e.g. Basic auth header
Template: Set HTTP header
Operations: Leave blank (applies to all operations)
Header name: Authorization
Header value: Basic [base64 encoded username:password]
Action if the header exists: override
Run policy on: Request
TB-13091842-0 140 on at

Like
a
(0)

Report
Copy link

Link copied!

I’m no expert, but there is another solution that I have just started implementing. It prevents the problems of implicitly sharing data sources, but would also solve the authentication problem here because you wouldn’t need individual user logins.

I use Windows authentication on my data source, SQL Server. Then I use Power Automate to do the data connections.

You have to create two flows, the first of which (parent) you connect to PowerApps. It calls a second flow (child) which has the step Execute SQL Server stored procedure. If data is being retrieved, the child returns it to the parent, which then returns it to the app. If you tried to use just one flow, then the SQL Server connection would be implicitly shared; moving the SQL Server connection to the child flow prevents that. All CRUD operations are performed by stored procedures in SQL Server, and I only have to pass in whatever parameters are needed.

I know from others that the same procedure can be used with other data sources, including SharePoint.
FoDelement 435 on at

Like
a
(2)

Report
Copy link

Link copied!

THIS!

This should be the answer. This answer just saved my butt! Thank you soooo much!!!!
Community Power Pla... Microsoft Employee on at

Like
a
(0)

Report
Copy link

Link copied!

Hey @FoDelement
Can you please assist me with which solution is really helping us to spot and authenticate the custom connection b2b users?
We have a power app application, having a custom connector, and it's asking for authentication for b2b users. we want to stop authentication. because b2b users are not able to authenticate.
Please suggest which solution help here