单页React App的Power Bi SSO已经是OIDC/OAUTH
我们有一个基于水疗React的应用程序。我们拥有自己的自定义构建IDP，即OIDC/OAUTH2.0合规性，我们的Web应用程序实现了“授权代码授予流”以进行身份验证（OIDC）并授权我们公司内的用户。
现在，我们必须将Power BI集成到我们的水疗中心，以允许用户（用户拥有数据）从我们的UI应用程序中启动Power BI网站，甚至其他选项是嵌入报告。我们想尝试这两个选项。
我已经介绍了该文档，将Power BI嵌入了Microsoft网站上的React应用程序中，但看来我必须向我们的公司UI网站注册Azure AD，并获得访问_Token以嵌入Power BI。由于我们的UI已经使用OIDC/OAUTH2.0流量使用我们的自定义IDP登录，Power Bi SSO如何在此基础上工作？
在上述情况下的假设是，用户已经登录到Azure AD中，因此让我们只专注于从我们的自定义Web应用程序中启动App.powerbi.com的SSO部分，或嵌入报告。
谢谢 琼斯
We have an existing SPA React based application. We have our own custom built IDP which is OIDC/OAuth2.0 compliant and our web application implements the Authorization code grant flow to authenticate (OIDC) and authorise users within our company.
Now, we have to integrate Power BI into our SPA to allow users (user owns data) to launch either the Power BI website from within our UI application or even the other option is to embed the reports. We want to try both the options.
I have gone over the documentation to embed Power BI into a react app on the microsoft website but it looks like I have to register our company UI website with Azure AD and get an access_token to embed Power BI. Since our UI already uses OIDC/OAuth2.0 flow to login using our custom IDP how is Power BI SSO going to work on top of that?
The assumption in the above case is that the user is already signed into Azure AD so let us focus only on the SSO part of either launching app.powerbi.com from within our custom web application or embedding the reports.
Thanks
Jithu
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
我不是OAuth专家，但是由于您的用户未使用AAD验证您的应用程序，我相信您不能使用 on-behalf-of flow 用户的Power BI访问令牌。您始终可以iframe 嵌入url 报告并让浏览器处理AUTH，但这不是无缝的SSO流程。
因此，最好的事情可能是将其对待，就好像它是App-owns-data嵌入一样，并使用您的注册应用程序的服务主体来获取自己的Power bi访问令牌，并使用它来为最终用户创建Power BI嵌入令牌，如所述在这里。
I am not an OAuth expert, but since your users aren't authenticated to your app with AAD I believe you can't use an On-Behalf-Of flow to get a Power BI Access Token for the user. You can always IFrame the embedding url of a report and let the browser handle auth, but that's not a seamless SSO flow.
So probably the best thing is to treat this as if it were App-Owns-Data embedding, and use your registered application's service principal to fetch its own Power BI Access Token, and use that to create a Power BI Embedding Token for the end user, as described here.