If two different users run a PowerApp which uses a custom connector at the same time, do they share same connection or do they each have their own connection?

[patrick4]

If a PowerApp uses a custom connector to call an API protected by ADB2C (or AD), if two different users (call them A and B) run the PowerApp at the same time, do they share same connection or do they each have their own connection?

For example, if user A opens the PowerApp and is asked to authenticate (because the connection has expired) and logs in (to the ADB2C or AD) with user A's credentials, and is then able to use the app logged in as A.

If user B then opens the PowerApp, does

Situation 1: the PowerApp automatically run using the connection that A created (so that user B is also effectively logged into the API as user A), or

Situation 2: the PowerApp says to user B: you need to create your own connection and asks them to authenticate, which B then does, so that A is using the app logged in as A, and B is using the app logged in as B (and both A and B are using different connections)?

Thanks!

[v-peijunz-msft]

Hi @patrick4 

To allow multiple users to use the custom connector, the app should be shared with others and the custom connector would be automatically shared. Users should create their own connections to it.

When users use this App for the first time, the App would need them to sign in with their own credential to generate a connection for each of them, it should be only for the first time App usage, if every time the user would need to sign in for the custom connector when using the App, then please consider update the App with an existing App owner.

Here are some docs for your reference:
Share resources used by canvas apps - Power Apps | Microsoft Learn

Share a custom connector in your organization | Microsoft Learn

Share a canvas app with your organization - Power Apps | Microsoft Learn

Hope it helps.

Best regards,

Sylvia

[patrick4]

Thanks, but your reply does not seem to be correct: 

I can open the app as user A in one browser, and (because the connection has expired [it is to an ADB2C directory] ) I am asked to update the connection which I do by logging in as user A. 

If I then open a different browser and open the app as user B, the app opens up automatically (without asking me to update the connection) and I can see from the app's output that the connection it is using is that for user B! 

That is not what we want, because if user A and user B have different data, user B should not be able to see or edit user A's data, or vice versa.

So it does look at the moment as if PowerApps share connections across users, when for security we want each user to have to create their own connection?

[WarrenBelz]

Hi @patrick4 ,

Have you tried different PCs ? I find myself (for example) often authenticated in Edge when I have signed in with Chrome. What @v-peijunz-msft has posted is to my knowledge correct. The only exception I know of is when a Flow with PowerAppsV2 trigger is set with elevated permissions on the connection and then it will run on the Flow connection creator.

[patrick4]

hi @WarrenBelz thanks, but I still get the same problem when I sign in to powerapps.com as user 2 on a different pc, and then open up the app.

It looks to me as if the connection is a property of the app, and not of the user who is opening the app?

I suppose another way to test this would be to add a Signout API method (or a CloseConnection method) and see whether this closes the connection just for the user who calls that method (which is what we want), or for all users using the app.

[WarrenBelz]

Hi @patrick4 ,

I am not sure what to add except I have never experienced any connector (except the PAV2 example is noted) not using the authentication of the logged-in user as it should.

[patrick4]

Thanks @WarrenBelz I tried it again today (using the Power app as user 1 on one pc, and as user 2 on a different one, in each case using Chrome in incognito mode) and this time it worked, I had to "fix the connection" on both the pcs.  

But I then closed down the browser on pc 1, and reopened it again, logging in again as user 1, and opened the app.  I was expecting it to use the connection for user 1, or possibly to ask me to "fix the connection"), but instead it opened up without asking me to fix the connection (I think because the connection has a login token to ADB2C which expires after several hours and so hasn't expired yet), and I can tell from the output the app produces that it is using the connection created this morning for user 2!

So it seems that if the app has one or more live connections, it doesn't ask a user to create a new connection, instead it chooses one of the live ones, almost at random!

That is not good behaviour for us, because user 1 gets to see user 2's data in this situation.

Is there a way to fix this please?

[WarrenBelz]

@patrick4 ,

I am simply a user like you - I suggest you lodge a Support Ticket with Microsoft

[patrick4 · Accepted solution]

Thanks @WarrenBelz . I raised a support ticket and was able to get the problem solved: the issue was that I had read somewhere that in order to share an app with another user, we not only had to share the app, but the environment the app was in, and the connection.

When we stopped sharing the connection, the problem went away.

[patrick4 · Accepted solution]

Solution

So the solution was to ignore the text shown when sharing an app which says "make sure you share connections" and not share the connection. 

That way each user has to create their own connection.