[BUG/Question] Use Organizational Account authentication from Excel #232
Comments
|
I've confirmed that the authentication works if I raise this 401 exception: if access_token is None:
raise InvalidAuth('No access token provided', request=request)
if access_token == "":
raise HTTPException(
status_code=401,
detail="Not authenticated",
headers={"WWW-Authenticate": f"Bearer authorization_uri={self.authorization_url}"},
)Plus a bit of hacking to make sure the exception is not caught and raised as an Now, the question is whether that could be supported natively in |
|
Could you try the latest release? |
|
I've just tried, and I'm still getting the same issue. Excel start the authentication process by sending a header |
|
Hmm.. These are documented, I guess. But they are also optional to implement. I find it strange that Excel don't allow for customization of these, without relying on the API. PR for a fix welcome, of course. I suspect something like this would be easiest: class UnauthorizedHttp(HTTPException):
"""HTTP exception for authentication failures"""
def __init__(self, detail: str, authorization_url: str | None = None, client_id: str | None = None ) -> None:
header_value = 'Bearer'
if authorization_url:
header_value += f', authorization_uri="{authorization_url}"'
if client_id:
header_value += f', client_id="{client_id}"'
super().__init__(
status_code=status.HTTP_401_UNAUTHORIZED,
detail={"error": "invalid_token", "message": detail},
headers={"WWW-Authenticate": header_value},
)and then fix except Exception as error:
log.warning('Malformed token received. %s. Error: %s', access_token, error, exc_info=True)
raise Unauthorized(
detail='Invalid token format',
client_id=self.app_client_id,
authorization_url=self.authorization_url,
request=request
) from errorCC @davidhuser |
|
As suggested, raised a Pull Request to add support. |
|
The checks on the PR are successful except for the upload of the code coverage: |
|
It is not, thanks for the PR! Maybe @davidhuser has some thoughts. |
|
Sorry to hear that. Hopefully you'll recover quickly and fully. Let's see what @davidhuser thinks in the meantime. |
|
I left a comment in the PR. Implementation looks good. I cannot comment on the validity of the requirement itself as I'm not an Azure admin anymore but I trust it's ok 🙂 I'm not sure whether to document the behavior in a new docs page or section or docstring, though. |
|
In terms of documentation, I'm thinking an optional step in the azure setup doc. Something along the line of? |
|
I don’t think we need to explicitly document it, honestly. It’ll just “work” for those who needs it. |
|
Released in 5.1.1 - thanks so much. 😊 |
Describe the bug
I would like to connect to FastAPI using Excel's PowerQuery and the Organizational Account authentication for the Web connector. When Excel tries to sign in, it sends a request with an empty Bearer token, and it expects a 401 response with the Entra ID authorize URI (see docs). But, at the moment, FastAPI is returning a 401 error
{"detail":"Invalid token format"}with a header'www-authenticate': 'Bearer'.How can I return a custom 401 error so that Excel PowerQuery can request its OAuth2 token and then interact with FastAPI?
To Reproduce
We were unable to connect because this credential type isn't supported for this resource. Please choose another credential type.Stack trace
FastAPI debug logs:
Your configuration
Backend Entra ID's app registration:
The text was updated successfully, but these errors were encountered: