Run a flow with a HTTP Request Trigger restricted to 'specific user' from another flow?

[tfraser]

I've searched the forum and google for an answer to this and can't find anything that helps.

I've also reviewed the information here but it seems to be over complicated and intended for developers who need to run the flow from a different platform (i.e. not using another Power Automate flow). Add OAuth authentication for HTTP request triggers - Power Automate | Microsoft Learn

How do you run a flow with a HTTP Request Trigger restricted to 'specific user' from another flow? Is the way described in the article the only way or is there a way that is more applicable to triggering one flow from another?

Scenario:

• I want to build a generic flow that can be called from other flows so I don't have to keep repeating the same steps.
• I cannot use the 'run a child flow' step since the child flow contains external connectors.
• I need to ensure only specific users in my tenant can request this flow.

So in my parent flow I need to run the child flow and receive a response that I can use in the parent flow.

HTTP Request with Azure AD

I expect that it should be possible to call the child flow that requires authentication using a "HTTP Request with Azure AD" step, however I can't get this to authenticate. I get an error of:

Create and authorize OAuth connection failed. AADSTS500011: The resource principal named https://prod-94.westeurope.logic.azure.com:443/workflows/[REDACTED]/triggers/manual/paths/invoke?api-version=2016-06-01 was not found in the tenant named [REDACTED]. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. You might have sent your authentication request to the wrong tenant.

I have tried setting the HTTP Request with Azure AD Base URL and Azure AD Resource URI to various combinations with the trigger URL including using 

https://login.microsoftonline.com

as the authentication URL.

HTTP Step

I know it's possible to use the generic "HTTP" step to include Azure AD authentication parameters, however I don't want to explicitly state the parameters in my flow, and I don't know how I would find them!

[David_MA]

I haven't used this action myself, but other developers in my company have used it and say it works well. You want to use the trigger When a HTTP request is received, which was recently updated so you can specify who can trigger it.

You can read more at Deeper control over HTTP invocation of flows | Power Automate Blog (microsoft.com)

[tfraser]

Hi @David_MA , thanks for your input.

Yes, my question is specifically about how to use that trigger and get it to run from another flow with a specific user specified. How are the other developers in your company triggering this trigger?

I can get it to work with 'anyone' specified but not a 'specific user'.

Thanks,

Thomas

[David_MA]

Based on your screen shots, you are not using the same HTTP action as I showed above. When you configure this action, it will generate a URL so your other flow can call a post action to the URL generated to start the workflow. I don't know what you mean by "'anyone' specified but not a 'specific user'". If you are specifying someone, they are by definition a specific user. In addition to specific users in your tenant, you can configure it to accept requests from anyone, and anyone in your tenant.

Here is a blog post showing how to use the action: Power Automate: When an HTTP request is received Trigger - Manuel T. Gomes (manueltgomes.com)

[tfraser]

@David_MA I appreciate your efforts to help with this. I will add some detail to make my question clearer.

My original question did not include a screenshot of the trigger of the flow I am trying to trigger. The screenshots show steps from another flow that I'm trying use to call the flow with the HTTP trigger from.

I.e. when I Run Flow 1 -> send an HTTP Request to Flow 2 with HTTP Trigger

For completeness, here is the trigger I am trying to trigger from another flow. It's currently set to be triggerable by 'Anyone' but I want to set it to 'Specific users in my tenant'

As you can see, you can select 'anyone' which allows anyone with the flow URL and signature key to trigger the flow by simply calling the URL. I don't want to select that as it's not as secure as I need it to be.

The question I'm asking is how you trigger this from another flow, when you select 'specific users in my tenant' since that requires authentication

I can't find anywhere that explains how to do that in simple terms.

The only place I've found that goes into any detail is here: Add OAuth authentication for HTTP request triggers - Power Automate | Microsoft Learn and I'm left with more questions than answers, since it doesn't seem to be geared around triggering one flow with the HTTP trigger from another flow with a HTTP request step.

Especially around the following 'claims' that need including in the request from Flow 1 to the Trigger of flow 2:

• "iss": <Issuer of the requestor>

What should this be set to?

Secondly, where in my HTTP request in Flow 1 should the claims be specified in order to successfully trigger the HTTP trigger of Flow 2?

Using some simplified examples to fill in for Flow 1 and Flow 2:

Flow 2 Using the HTTP Trigger

If I try to call Flow 2 from Flow 1 I get the following error:

Flow 1 using a HTTP Request to Trigger Flow 2

{
  "error": {
    "code": "DirectApiAuthorizationRequired",
    "message": "The OAuth authorization scheme is required. Please add authentication scheme and try again."
  }
}

I can change my HTTP request to use Active Directory OAuth:

But in that case what should be specified as the Client ID and Client Secret? Is the secret a static value and how do I find out what this is? This seems insecure.

Given it seems to be trying to use Azure AD for Authentication, it seems it should be possible to trigger the trigger using an 'Invoke HTTP Request with Azure AD' step, which would then add a connection using my credentials to the flow without having to explicitly state a secret - which seems like a more secure and simpler option.

However, if it's possible to trigger the http trigger this way - what should be specified as the Base URL and Azure AD Resource URI in the connection settings? As you can see in my original question, I've tied various values here but failed.

[David_MA]

To specify the users, you choose specific users in my tenant and then enter their e-mail addresses separated by semicolons:

This is a premium connector, so the run users must have a premium Power Automate license to run it.

[tfraser]

Hi David, yes I understand that.

In my tests I have added my email address to the list of allowed users.

The question is how do I run this flow from another flow by, for example, using a step which sends a HTTP request using the trigger URL?

I am able to do this with 'Anyone' as the selected option, but not when I select 'Specific Users' and add my email address.

[David_MA]

They are using it by sending an HTTP post request to the URL generated from this action with the JSON data needed to process the request. As I mentioned in my original post, I have not used as I haven't had a need, so I am not familiar with all the ins and outs of it. Other folks in my company are using it instead of using the Call a child flow action or using an action with trigger conditions. Hopefully someone else will see your post who has used this action and can provide more assistance.

[tfraser · Accepted solution]

Thanks to @davidyc for pointing me in the right direction with this.

The following articles explain how to get this to work in detail.

P1 - Securing "When an HTTP Request is Received" trigger in Power Automate (bythedevs.com)

P2 - Securing "When an HTTP Request is Received" trigger in Power Automate (bythedevs.com) which goes into a bit more detail on how to enable this for a specific user.

Also for reference: a bit more detail on triggering this from an external service found here: powerusers.microsoft.com/t5/Building-Power-Apps/New-Feature-When-a-HTTP-Request-is-Received-Trigger-...

Essentially if you need to be able to trigger a flow using the HTTP request trigger restricted to a specific user or users in your tenant from a step in another flow you need to:

1. Install an App to your tenant granting permission for AAD to authenticate users to Power Automate APIs
2. Use the 'Invoke an HTTP Request' with Azure AD connector set to the following URLs:
   1. Connection Base Resource URL [Full URL from your HTTP Trigger]&sp=%2Ftriggers%2Fmanual%2Frun - note this last bit added to the end of the URL provided by the trigger - it doesn't work for me without it
   2. Connection Azure AD Resource URI (Application ID URI): https://service.flow.microsoft.com/ (as I understand it, this is the application that you need to grant permission to in your tenant)
   3. Connector URLL [Full URL from your HTTP Trigger
3. The 'Invoke an HTTP Request' cannot be set to 'Asynchronous'

You need to handle a flow that requires an asynchronous response differently. There's a good article on that here Pattern & implementation for making long Async Http calls in Microsoft Flow : (part 1 : polling) | S... but essentially you just need to get the 'Location' URL from the 202 response and keep calling that using a standard HTTP request in a 'do until' loop until the status is no longer 202. Also - if you need to handle a large response you may need to turn on 'chunking'.

It's not at all obvious that we should have to register an app in Azure AD / Entra ID for this to work, at least not for me as I've never had to do that for anything else in Power Automate - it would be great if Microsoft would start providing documentation for how to use these features!

It took me a while to figure out because I had the 'asyncrhonous' setting turned on for the connector and kept getting an error

{

  "error": {

    "code": "DirectApiInvalidAuthorizationScheme",

    "message": "The provided authentication token is not valid. Only 'basic' or 'bearer' type of token is supported."

  }

}

Once I turned off asynchronous responses everything worked!

[dlprentice]

Awesome thanks! I got this working in GCCH

[ForIllinois]

After trying to trigger a flow using specific users in my tenant via PowerShell and having no luck, I discovered a YouTube video that should essentially be included in Microsoft’s documentation. Since it isn’t, here’s the title and the link to it:

Title: OAuth Authentication for Power Automate HTTP Request Trigger | Dynamic Bites

Link: https://youtu.be/U1qykshQxRY?feature=shared

[meierij]

Hi, do you perhaps also know how to setup a webhook using the 'Plugin Registration Tool'? All the examples use the 'signature' parameter which should be generated in the URL, but I only get the 'api-version' parameter.