How to store credentials in Power BI DataConnector?

Question

I'm building a custom Power BI DataConnector which uses OAuth. I'm following the github example. But this stores client credentials (required for the 'code flow' in OAuth) as plain text files. Is there a secure alternative to this ?

Answer 1

Unfortunately due to the current "state of the art" there is no way to securely protect these credentials according to Microsoft staffer Curt Hagenlocher:

There is no way to protect a secret on someone's desktop. That's why some OAuth providers (like AAD) support a "native app" mode where there's a client id but no secret. The most recent development in this space is PKCE, and we're aiming to have sample code for that later this year.

In principle, a secret could be supplied separately for service use -- and I'd like to see us do that some day -- but there's a lot of infrastructure which would need to be created to support that.

I suggested encryption of the module itself and Curt's response was that this too would be ineffective:

All someone needs to do is have Fiddler running and they can see exactly what secret is being sent to the token endpoint.

Full conversation:

https://github.com/microsoft/DataConnectors/issues/298