Implicitly Sharing Custom Connectors in PowerApps

[Christoph_G]

Hello everyne,

I have already built a custom connector using basic authentication and it works fine (technically).

The only issue I am facing is that every user which opens the App has to enter the credentials for the basic authentication (of the data source) of the custom connector by his/her own which is not feasible in my scenario as normal users do not know the credentials they have to enter.

Is there a way to pass the credentials directly to the data source in a custom connector or to "share the connection" (connector+credentials) instead of the connector alone along with the app.
I would like this to work like the SQL-Server-Connection which is also "implicitly" shared along with the powerapp without the need of having end users enter any credentials for the SQL-Server.

Thank you in advance for your support and ideas 🙂

[v-yuxima-msft]

hI @Christoph_G 

How do you create your customer connector?

I test with this, and the Authentication type I  choose as no authentication,when I share the app, there is no need to fill credentials, and user can use it directly.

And more information:

register-custom-api

https://powerusers.microsoft.com/t5/General-Discussion/How-exactly-does-sharing-an-app-with-connecto...

Hope this could be helpful.

Best Regards.

Yumia

[Christoph_G]

Hi @v-yuxima-msft ,

thank you for your quick reply.

When i choose no authentication I get a 401 (Unauthorized) since the API i am talking to needs basic authentication credentials in order to "let me in".

I was really asking if it is possible to pass on the credentials within the connector (definition) so that a powerapps-api-call via the custom connector always uses those credentials without end users ever having to enter them.

I hope it is understandable what I am trying to say 😄

Thank you and kind regards
Christoph

[alaugMSFT]

Hi, @Christoph_G. 

When you a create a custom connector configured with an authentication type of generic Oauth 2.0, Oauth 2.0 for specific services or Basic authentication, by default the PowerApp user will be prompted to provide credentials so the app can create a connection. 

A custom connector with authentication type 'API Key' won't prompt the end user for credentials. The authentication details are specified when creating an app that uses this type of connector, when the app is shared the connection already exists and end users won't be prompted for creds.

The authentication types that can be defined in a custom connector are outlined here. 

Also, an easy way to confirm if a connection is automatically shared with app users is outlined here.

Lastly, there is one more alternative to the info above, when you create a connection for your app using basic auth you can share the connection with the same users the app is shared with. Note, basic auth connections are not implicitly shared with users when an app is shared with them. For instance, go to https://make.powerapps.com > Data > Connections > Select the connection you created for the app to be shared > In the details pane of the connection there is a 'share' button.

[Christoph_G]

Hello @alaugMSFT;

you are writing that with OAuth2.0 and Basic, users are "by default" prompted to enter credentials so that the app can create a connection.
Is there a way to bypass that with basic authentication? I have to use basic authentication.

Authentication Type "API KEY" is unfortunately not available since I connect via onPremises Data Gateway.
As soon as this Gateway-Checkbox is checked I only have "Windows" and "Basic", whereas I as already said have to use basic for the connector to work.

Lastly a question to your last paragraph:
I looked inside my Connections (of the Custom Connector) and they are shareable.
So If I share the Connection (NOT the connector) with Users before I share the App with them they won't be prompted to enter their own credentials in basic?

Thank you and kind regards
Christoph

[alaugMSFT · Accepted solution]

Correct, the only way to preempt the user authentication is by sharing a connection with them (so the user won't have to auth to create a new connection). 

[artem1313]

Is it still true? I have created PowerApps that is using custom connectors and use Basic token to authenticate. I just talked to someone at MS support and they told me that users of PowerApp will have to authenticate the first time, even if I share connectors with them. Please let me know.

[Anonymous]

Hi!

You can also use policies to achieve this. Set Authentication type to No authentication on the Security tab and create a new Policy on the Definition tab with the following settings:

Name: Any name here, e.g. Basic auth header

Template: Set HTTP header

Operations: Leave blank (applies to all operations)

Header name: Authorization

Header value: Basic [base64 encoded username:password]

Action if the header exists: override

Run policy on: Request

[TedBabcock]

I’m no expert, but there is another solution that I have just started implementing. It prevents the problems of implicitly sharing data sources, but would also solve the authentication problem here because you wouldn’t need individual user logins. 

I use Windows authentication on my data source, SQL Server. Then I use Power Automate to do the data connections.

You have to create two flows, the first of which (parent) you connect to PowerApps. It calls a second flow (child) which has the step Execute SQL Server stored procedure. If data is being retrieved, the child returns it to the parent, which then returns it to the app. If you tried to use just one flow, then the SQL Server connection would be implicitly shared; moving the SQL Server connection to the child flow prevents that. All CRUD operations are performed by stored procedures in SQL Server, and I only have to pass in whatever parameters are needed. 

I know from others that the same procedure can be used with other data sources, including SharePoint. 

[FoDelement]

THIS!

This should be the answer. This answer just saved my butt! Thank you soooo much!!!!