"error_description":"AADSTS700025: Client is public so neither 'client_assertion' nor 'client_secret' should be presented

[dcsolus]

Hi, there.

I've got another issue with setting up airflow connection. Using refresh token works perfectly fine, but my concern is that we need update refresh token periodically but there is no way of addressing when the refresh token is due. So I tried out 'clientSecret' in Extra in order not to resort to updating refresh token, resulting in an error:

"error_description":"AADSTS700025: Client is public so neither 'client_assertion' nor 'client_secret' should be presented

When I remove 'clientSecret' from Extra while keeping 'tenantId' alone, my Dag normally works as expected. I was wondering if you could help me out with this?

[dcsolus]

I think I've found what gets the error message. The issue is 'clientSecret' is a typo in the README. Now I used 'client_secret' instead, it worked fine.

Now that the error message have been sorted out, will I not need to update the refresh token some day once I start using 'client_secret'?

[ambika-garg]

Hey @dcsolus, The plugin itself updates the refresh_token, you don't need to update it.

[dcsolus]

One more clarification. Should I include 'client_secret' in Extra to make the plugin update the refresh token by itself? If not, when do I need to use 'client_secret'?

[ambika-garg]

No, you don't need to pass client secret for refresh token renewal. Client Secret is only required in case of web apps.

[ambika-garg]

Also, can you show me the extra field where you passed "client_secret"?

[dcsolus]

Here's the extra file below. As I explained, 'clientSecret' is not working. 'client_secret' should be used instead:

{ "tenantId": "<my-tenant-id>", "client_secret": "<my-secret-value>" }

[ambika-garg]

Thanks for letting me know. I'm not certain about it. Let me check it. I think error resolution might be something else.

[ambika-garg]

Can try passing { "tenantId": "<my-tenant-id>", "clientSecret": "<my-secret-value>" } once again and share the logs with me?

[dcsolus]

Here's the logs with some DLP applied:

[2024-09-12, 14:54:20 KST] {base.py:84} INFO - Using connection ID 'fabric_conn' for task execution. [2024-09-12, 14:54:21 KST] {taskinstance.py:441} ▼ Post task execution logs [2024-09-12, 14:54:21 KST] {taskinstance.py:2905} ERROR - Task failed with exception Traceback (most recent call last): File "/root/airflow-venv/lib/python3.10/site-packages/apache_airflow_microsoft_fabric_plugin/hooks/fabric.py", line 132, in _get_token response.raise_for_status() File "/root/airflow-venv/lib/python3.10/site-packages/requests/models.py", line 1024, in raise_for_status raise HTTPError(http_error_msg, response=self) requests.exceptions.HTTPError: 401 Client Error: Unauthorized for url: https://login.microsoftonline.com/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/oauth2/v2.0/token During handling of the above exception, another exception occurred: Traceback (most recent call last): File "/root/airflow-venv/lib/python3.10/site-packages/airflow/models/taskinstance.py", line 465, in _execute_task result = _execute_callable(context=context, **execute_callable_kwargs) File "/root/airflow-venv/lib/python3.10/site-packages/airflow/models/taskinstance.py", line 432, in _execute_callable return execute_callable(context=context, **execute_callable_kwargs) File "/root/airflow-venv/lib/python3.10/site-packages/airflow/models/baseoperator.py", line 401, in wrapper return func(self, *args, **kwargs) File "/root/airflow-venv/lib/python3.10/site-packages/apache_airflow_microsoft_fabric_plugin/operators/fabric.py", line 122, in execute self.location = self.hook.run_fabric_item( File "/root/airflow-venv/lib/python3.10/site-packages/apache_airflow_microsoft_fabric_plugin/hooks/fabric.py", line 214, in run_fabric_item headers = self.get_headers() File "/root/airflow-venv/lib/python3.10/site-packages/apache_airflow_microsoft_fabric_plugin/hooks/fabric.py", line 161, in get_headers "Authorization": f"Bearer {self._get_token()}", File "/root/airflow-venv/lib/python3.10/site-packages/apache_airflow_microsoft_fabric_plugin/hooks/fabric.py", line 135, in _get_token raise AirflowException(msg) airflow.exceptions.AirflowException: Response: {"error":"invalid_client","error_description":"AADSTS700025: Client is public so neither 'client_assertion' nor 'client_secret' should be presented. Trace ID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx Correlation ID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx Timestamp: 2024-09-12 05:54:21Z","error_codes":[700025],"timestamp":"2024-09-12 05:54:21Z","trace_id":"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx","correlation_id":"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"} Status Code: 401 [2024-09-12, 14:54:21 KST] {taskinstance.py:1206} INFO - Marking task as FAILED. dag_id=fabric_items_dag, task_id=run_fabric_notebook, run_id=manual__2024-09-12T05:54:16.017980+00:00, execution_date=20240912T055416, start_date=20240912T055420, end_date=20240912T055421 [2024-09-12, 14:54:21 KST] {standard_task_runner.py:110} ERROR - Failed to execute job 100 for task run_fabric_notebook (Response: {"error":"invalid_client","error_description":"AADSTS700025: Client is public so neither 'client_assertion' nor 'client_secret' should be presented. Trace ID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx Correlation ID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx Timestamp: 2024-09-12 05:54:21Z","error_codes":[700025],"timestamp":"2024-09-12 05:54:21Z","trace_id":"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx","correlation_id":"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"} Status Code: 401; 115751) [2024-09-12, 14:54:21 KST] {local_task_job_runner.py:243} INFO - Task exited with return code 1 [2024-09-12, 14:54:21 KST] {taskinstance.py:3503} INFO - 0 downstream tasks scheduled from follow-on schedule check

[dcsolus]

hi Ambika, is there any update related to the logs I shared?

[ambika-garg]

Hey @dcsolus, apologies for the delayed response, I was out of office last week. I’ll prioritize this and provide an update soon.

[ambika-garg]

Hey @dcsolus, This issue occurs mostly when you are using public client, please use web app. Refer to the link, This solution worked for me.

[geekindata]

Hi @dcsolus!
It's necessary to mention client_secret in the Extra params inside the fabric connection.

Check this out for reference: https://www.linkedin.com/pulse/automate-your-microsoft-fabric-workloads-apache-neelakantam-kz1if/

[dcsolus]

Hi @geekindata,

Thanks so much for the update!