implement create new Lakehouse in our workload

[box-turtle]

We have a Lakehouse explorer component and want to implement "Add a lakehouse" functionality.

Can we call the same API that is being called above? Will this allow users from other companies to create a lakehouse in their subscription?

https://wabi-us-north-central-j-primary-redirect.analysis.windows.net/metadata/workspaces/add277b2-6fd2-4664-b967-7a8968b055a4/artifacts

[ramizsha]

Hi @box-turtle,
No, you can't use the same API.
Please refer to the public API instead: https://learn.microsoft.com/en-us/rest/api/fabric/lakehouse/items/create-lakehouse?tabs=HTTP

[kedar-lanka]

@ramizsha i tried this (locally also from backend deployed in kubernetes) but when i use the token that is passed from frontend along for confidential client it gives me invalid subject, audience, issuer

from msal import ConfidentialClientApplication
token = "<generated_by_front_end>"
app = ConfidentialClientApplication(client_id="xxx-xxx-xxxx", client_credential={"client_assertion": token})
downstream_api_access_token = app.acquire_token_on_behalf_of(user_assertion=token, scopes=["FabricLakehouse.Read.All"])
currently both frontend and backend are using the same App so the app has permissions.

frontend is generating token same as the sample here

[ramizsha]

Please note that scopes should include the audience as well, for example:
downstream_api_access_token = app.acquire_token_on_behalf_of(user_assertion=token, scopes=["https://analysis.windows.net/powerbi/api/Lakehouse.Read.All"])
You can see the audience & scope for each permission on your application under API permissions (just click on the permission and a side pane should open).

[tjroberts]

I followed Kedar's code above with the additional scope and got this result:

>>> token = "<generated_by_front_end>"
>>> app = ConfidentialClientApplication(client_id="<client-id>", client_credential={"client_assertion": token})
>>> downstream_api_access_token = app.acquire_token_on_behalf_of(user_assertion=token, scopes=["FabricLakehouse.Read.All", "https://analysis.windows.net/powerbi/api/Lakehouse.Read.All"])
>>> print(downstream_api_access_token)

{'error': 'invalid_client', 'error_description': 'AADSTS70025: Client application has no configured federated identity credentials. Trace ID: 7b44057e-dcc3-42bd-8435-fe8b8c959c00 Correlation ID: 024f3923-f3b0-4f45-b941-69d4fa7b954f Timestamp: 2024-07-25 23:18:46Z', 'error_codes': [70025], 'timestamp': '2024-07-25 23:18:46Z', 'trace_id': '7b44057e-dcc3-42bd-8435-fe8b8c959c00', 'correlation_id': '024f3923-f3b0-4f45-b941-69d4fa7b954f'}

[tjroberts]

@ramizsha Can you please provide a full example of how this token can be generated?

[ramizsha]

@tjroberts You did not provide the client secret when initializing the ConfidentialClientApplication.
Also, the first scope you provided "FabricLakehouse.Read.All" is misisng an audience, in that case the audience is considered to be graph.
See example of initializing (in c#) here: https://github.com/microsoft/Microsoft-Fabric-workload-development-sample/blob/main/Backend/src/Program.cs (AddMsalConfidentialClientApplication).
And see example of OBO flow here: https://github.com/microsoft/Microsoft-Fabric-workload-development-sample/blob/main/Backend/src/Controllers/LakeHouseController.cs (_authenticationService.GetAccessTokenOnBehalfOf).
Please note that using a secret is only recommended when developing the workload, In production however, certificates are recommended as they're more secure than client secrets.