Fabric Connections
Connections is an Add-On for dab Nexus. They must be licensed separately.
Requirements
Before connecting to Fabric, there are a number of steps that must be completed in the Azure portal. Only when these have been successfully completed, will the dab Nexus application be able to connect to Fabric.
- Service User: Disable MFA (Multi-Factor Authentication) for this user (if enabled)
- App registration: Microsoft Identity Platform - see the Microsoft Documentation for details
All steps in this Microsoft documentation must be followed.
The following steps in the documentation are Nexus specific:
App registrations
- Open the App Registrations in the Azure portal and select + New Registration
- Name: enter a name for the registration
- Supported account types: select the option Only accounts in this organisation directory (single tenant)
- Redirect URI (optional): select Web from the drop down list (Nexus is a web application) & enter the dab Nexus application URL to the right of it
- Application-URL (On-Premise): you can find it in the Configuration.json
- Application-URL (Managed App): open the Resource Group in the Azure Portal, open the entry with the type App Service further down in the overview list, and you will find the Default domain in the top right-hand corner.
Once you have entered all the information, you can click Register at the bottom:
API permissions
Several authorisations must be entered here. To do this, click on Add a permission and select Microsoft APIs - you can find more information in this Microsoft Documentation.
Authorisations for the Fabric Mirrored Database
- Select Power BI Service and then Delegated Permissions
- Open the node MirroredDatabase and select MirroredDatabase.ReadWrite.All
- Open the node Workspace further down and select Workspace.Read.All
- Then click Add permissions
Authorisations for Fabric Lakehouse
- Select Power BI Service and then Delegated Permissions
- Open the node Lakehouse and select Lakehouse.ReadWrite.All
- Open the node SparkJobDefinition further down and select SparkJobDefinition.Execute.All and SparkJobDefinition.ReadWrite.All
- Then click Add permissions
Authorisation in Azure Storage
- Select Azure Storage and than tick user_impersonation
- Then click Add permissions
Once you have entered all the permissions, click Grant admin consent for *Tenant name* and confirm the message with Yes - see this section of the Microsoft Documentation for more information.
The list in API Permissions should look like this:
Once you have completed all the steps in the documentation, you will receive the Client ID required to connect to your dab Nexus application.
Authentication for App Registration
In this section you must allow the Public client flows:
- Open your App registrations
- Go to Authentication
- Scroll to the bottom and set the Allow public client flows slider to Yes
- Then click on Save
Assign authorisations in Fabric
On the Microsoft Fabric side, the user must have at least the Contributor role!
Go to the URL https://app.powerbi.com, log in as the user and click Workspaces on the left hand side.
Move the mouse over the general workspace name and click the three dots.
Then select Workspace Access and you will see all users and their roles on the right.
Create a Connection in dab Nexus
Open your dab Nexus application, log in and click Settings > Connections > + Connection
Fabric Mirrored Database
Enter a name for the Connection to the Fabric Mirrored Database in the top left-hand corner.
General
- Tenant ID: you can find this in the Azure Portal > App Registrations > *Your Nexus App* > Overview in Essentials under Directory (tenant) ID
- Client ID: you can find this in the Azure Portal > App Registrations > *Your Nexus App* > Overview in Essentials under Application (client) ID
- Authentication Type
- Basic Authentication
- Username & Password: enter the user and password of the Fabric User
- Request API consent: here you need to accept the required permissions once
- Service Principal
- Service Principal Key: you can find this in the Azure Portal > App Registrations > *Your Nexus App* > Manage > Certificates & secrets. In the webpage, select Client secrets. Enter the key under the Value field. This is your Service Principal Key.
- Basic Authentication
- Login with Microsoft:
- If the authentication type is Basic Authentication, the Fabric user credentials will now be validated (disable MFA, if enabled). If verification is successful, the Request API consent & Login to Microsoft buttons will be replaced by the Reset Authentication button.
- If the authentication is via Service Principal, then all the fields entered and the User will be validated. On successful validation, the fields below will be accessible.
- Fabric Workspace: after successful authentication, you can select your Fabric Workspace
- Fabric Mirror: after selecting the desired workspace, select an existing Fabric Mirror or create a new one
Permissions
You can authorise individual teams or users for this Connection in this section. If you do not make a selection here, all users and teams will be automatically authorised!
Create & Close
Save your settings and return to a table overview of all Connections. Finally, test the connection. Click on the three dots to the far right of the new Connection and click on Test Connection. If you receive the message Connection test successful, the connection is ready to be used in dab Nexus.
Fabric Lakehouse
Enter a name for the Connection to the Fabric Lakehouse in the top left-hand corner.
General
- Tenant ID: you can find this in the Azure Portal > App Registrations > *Your Nexus App* > Overview in Essentials under Directory (tenant) ID
- Client ID: you can find this in the Azure Portal > App Registrations > *Your Nexus App* > Overview in Essentials under Application (client) ID
- Username & Passwort: enter the user and password of the Fabric User
- Request API consent: here you need to accept the required permissions once
- Login with Microsoft: the Fabric user credentials will now be validated (disable MFA, if enabled). If verification is successful, the Request API consent & Login to Microsoft buttons will be replaced by the Reset Authentication button.
- Fabric Workspace: after successful authentication, you can select your Fabric Workspace
- Fabric Lakehouse: after selecting the desired workspace, select an existing Fabric Lakehouse or create a new one
Permissions
You can authorise individual teams or users for this Connection in this section. If you do not make a selection here, all users and teams will be automatically authorised!
Create & Close
Save your settings and return to a table overview of all Connections. Finally, test the connection. Click on the three dots to the far right of the new Connection and click on Test Connection. If you receive the message Connection test successful, the connection is ready to be used in dab Nexus.
