DataBricks API Powershell

user_15470662 0
Viewed 284

I'm having an issue using the databricks api 2.0

The invoke-rest method fails for the following error: "Error 400 io.jsonwebtoken.IncorrectClaimException: Expected aud claim to be: https://management.core.windows.net/, but was: https://management.azure.com."

I followed the instructions in the microsoft docs.

cls

$DataBrick = <DataBrickURL>

$DataBricksResourceID = <ResourceID>

$VaultName = <KeyVault>
$KeyName = <Key>

$apiEndpointUri = "https://management.azure.com"  
$tenantId = <TenantID>  
$applicationId = <ApplicationID> 
$secret = Get-AzKeyVaultSecret -VaultName $VaultName -Name $KeyName -AsPlainText

$RequestAccessTokenUri = "https://login.microsoftonline.com/$tenantId/oauth2/token"
$body = "grant_type=client_credentials&client_id=$applicationId&client_secret=$encodedSecret&resource=2ff814a6-3304-4ab8-85cb-cd0e6f879c1d" 
$Managementbody = "grant_type=client_credentials&client_id=$applicationId&client_secret=$encodedSecret&resource=$apiEndpointUri"  
$contentType = 'application/x-www-form-urlencoded' 

$AccessToken = Invoke-RestMethod -Method Post -Uri $RequestAccessTokenUri -Body $body -ContentType $contentType  
Write-Output $AccessToken
$ManagementToken = Invoke-RestMethod -Method Post -Uri $RequestAccessTokenUri -Body $Managementbody -ContentType $contentType
Write-Output $Token

$apiuri = $DataBrick +"/api/2.0/clusters/get"
$headers = New-Object "System.Collections.Generic.Dictionary[[String],[String]]"
$headers.Add("Authorization", "Bearer " + $AccessToken.access_token)
$headers.Add("X-Databricks-Azure-SP-Management-Token", $ManagementToken.access_token)
$headers.Add("X-Databricks-Azure-Workspace-Resource-Id", $DataBricksResourceID)

Invoke-RestMethod -Uri $apiuri -Headers $headers
azure-databricks databricks powershell
2 Answers

AS per documentation, resource parameter (your apiEndpointUri variable) should be https://management.core.windows.net/, but you have https://management.azure.com

Alex_Ott_186270

Based on e.g. mentioned in Question, There are following steps are happening:

  1. Get a token from Microsoft login service for provided resource id of databircks.
  2. Get a management Token. In your e.g., it is provided as "https://management.azure.com" which is not correct. You needs to use "https://management.core.windows.net/" which is mentioned in error response too. You can refer https://docs.microsoft.com/en-us/azure/databricks/dev-tools/api/latest/aad/service-prin-aad-token#--api-access-for-service-principals-that-are-not-workspace-users for reference which is not for Powershell but useful enough to understand authentication flow
  3. Using both tokens, to call Databricks APIs

In short, if you correct apiEndpointUri based on error. It should work provided other details are correct and have correct permission configured.

user_102932530
Related