mssparkutils credentials library in notebook

[g3kuser]

Hi

With recent support of SPN authentication with Fabric ci-cd libraries, I am trying to deploy pipelines and notebook through SPN. I see the item owner as the SPN.  I have the following code in notebook which doesn't mention any credential. Is this using SPN credentials/User credential/Workspace Identity. 

secret_value = notebookutils.mssparkutils.credentials.getSecret(keyvault_url,'secret_name)

mssparkutils.credentials.getToken("https://api.fabric.microsoft.com/")

I have not given workspace identity access to key vault so I doubt if secret reading call goes that that auth.

I did notice in Monitoring when notebook executed through a pipeline has submitted user for notebook execution as SPN who is the item owner as well.

Can anyone help me in understanding the process?

Thanks,

Gayatri

[nilendraFabric · Accepted solution]

Hi @g3kuser 

When you call the mssparkutils credentials functions without specifying any explicit credentials or linked service parameters, the runtime automatically uses the identity under which the notebook is executing. In your case, because the notebook is being deployed and run through a Fabric pipeline configured with SPN authentication—and the SPN appears as the item owner—the mssparkutils calls are using the service principal’s credentials.

In your current setup, since no explicit workspace identity configuration is provided (or its permissions granted for Key Vault access), the secret retrieval and token acquisition calls fall back to using the SPN credentials

[g3kuser]

Thank you for the explanation. As the executing user is SPN I am unable to understand how token was retrieved without the need of client secret to be supplied for the process. 

[g3kuser]

Hi @nilendraFabric 

I am curious to understand how it worked without the need for client secret to be passed to the process.