I have a use case where I want to store some client id and secret in my own company’s Azure keyvault.Then I have a component which needs to use the client id and secret to authenticate against a 3rd party, so I can issue a GET call to get some data. So I am thinking:Runtime server authenticate against keyvault Runtime server issue a “get secret” call to keyvault Keyvault sends back the secret Runtime server takes the secret and authenticate against 3rd party Runtime server issue a “get data” call to 3rd party 3rd party sends me back the actual data What authentication methods from runtime server to keyvault are supported? I had a look at Azure keyvault’s documentation but I don’t think I understand it fully. https://learn.microsoft.com/en-us/azure/key-vault/general/authentication Has anybody else done it? What’s your experience?

Solved

Runtime server / ONE Desktop connection to Azure Keyvault

7 months ago
September 5, 2024
6 replies
81 views

+4

may_kwok
Star Blazer L3
82 replies

I have a use case where I want to store some client id and secret in my own company’s Azure keyvault.

Then I have a component which needs to use the client id and secret to authenticate against a 3rd party, so I can issue a GET call to get some data.

So I am thinking:

Runtime server authenticate against keyvault
Runtime server issue a “get secret” call to keyvault
Keyvault sends back the secret
Runtime server takes the secret and authenticate against 3rd party
Runtime server issue a “get data” call to 3rd party
3rd party sends me back the actual data

What authentication methods from runtime server to keyvault are supported? I had a look at Azure keyvault’s documentation but I don’t think I understand it fully. https://learn.microsoft.com/en-us/azure/key-vault/general/authentication

Has anybody else done it? What’s your experience?

Best answer by AKislyakov

Hi @maykwok_hamilton,

The only supported authentication options for URL resources in Runtime Server are: Basic, Open ID Connect (with client/secret) and mTLS. The Secret Manager you mentioned is only applicable for One Gen2 sources.

Can’t speak for any authentication method, but for OAuth2 there is an option to send client_id/client_secret via Basic auth header.
So, your first call will look like following (these are connections ##2 and 3 on your diagram, but they go to Microsoft OAuth):

with an Url Resource configured like this

<url name="EntraApiToken" url="https://login.microsoftonline.com/<TENANT>/oauth2/v2.0/token">
    <authConfig user="<CLIENT_ID>" password="<CLIENT_SECRET>" class="com.ataccama.dqc.processor.bin.config.auth.BasicAuthConfig"/>
</url>

View original

Did this topic help you find an answer to your question?

+4

may_kwok
Author
Star Blazer L3
82 replies
7 months ago
September 5, 2024

We found this in the docs:

Secret Management Services :: Ataccama ONE

But it looks like it’s only available in ONE, not in runtime server. And that this is v15. We are still on v14 right now.

Any chance this could be available in runtime server at some point?

( cc @Scott Barden @DannyRyan )

+4

may_kwok
Author
Star Blazer L3
82 replies
6 months ago
September 9, 2024

I drew a diagram hoping to make it clearer

If someone from Ataccama has any comments it would be greatly appreciated!

+4

may_kwok
Author
Star Blazer L3
82 replies
6 months ago
September 17, 2024

Anyone has any ideas?

I suppose this actually extends beyond keyvault. What if when you need to do OAuth / any authentication method that goes beyond the simple username/password or client_id/client_secret, short of storing the creds in plain text in a json call step (or passing as parameters from .ewf or .sch, but it’ll still be on plain text in git project), what other options do I have?

(Cheekily tagging @AKislyakov - have you had to deal with something like this before?)

A

+2

AKislyakov
Ataccamer
146 replies
Answer
6 months ago
September 18, 2024

Hi @maykwok_hamilton,

The only supported authentication options for URL resources in Runtime Server are: Basic, Open ID Connect (with client/secret) and mTLS. The Secret Manager you mentioned is only applicable for One Gen2 sources.

Can’t speak for any authentication method, but for OAuth2 there is an option to send client_id/client_secret via Basic auth header.
So, your first call will look like following (these are connections ##2 and 3 on your diagram, but they go to Microsoft OAuth):

with an Url Resource configured like this

<url name="EntraApiToken" url="https://login.microsoftonline.com/<TENANT>/oauth2/v2.0/token">
    <authConfig user="<CLIENT_ID>" password="<CLIENT_SECRET>" class="com.ataccama.dqc.processor.bin.config.auth.BasicAuthConfig"/>
</url>

+4

may_kwok
Author
Star Blazer L3
82 replies
6 months ago
September 18, 2024

Ooh this is one combination I haven't tried. Going to give it a go today, thank you!

+4

may_kwok
Author
Star Blazer L3
82 replies
6 months ago
September 19, 2024

Yes, it worked! Thanks @AKislyakov !

Reply

Rich Text Editor, editor1

Runtime server / ONE Desktop connection to Azure Keyvault

6 replies

Reply

Most Liked this week

Cookie policy

Cookie settings

Reply

Related topics

create the schema.json fileicon

How do you understand which customer segments are most actively engaged?

Limit of 30 items in a group by or Breakdown table?icon

Use an event property id in place of user_idicon

How to download all events of specific users in amplitude?icon

Most Liked this week

Sign up

Login to the Ataccama Community

Scanning file for viruses.

This file cannot be downloaded

Cookie policy

Cookie settings