Create/update/share/delete Connections [with Service Principal] via PAC CLI

[jboliveira]

Context

Currently, as indicated in discussion #452, we experience difficulties maintaining Dataverse connections, particularly those created with Service Principals.

Given that Service Principal rotation is strongly encouraged to be performed on a regular basis for security reasons, it also leads to nested operations, such as the regeneration of the connection with the new clientSecret, obtain the new connectionId to be placed in the deploymentSettings.json, re-deploy the solution with the new connection Ids, and so on.

It's also worth noting that creating a Dataverse connection with Service Principal is only feasible during the establishment of a fake flow, which won't even be saved at the end.

Idea

Would be ideal if we could create/update/share/delete connections with Service Principal (if applicable) using PAC CLI.

Commands

pac connection

Usage: pac connection [create] [update] [share] [delete] [show] [list]

command	description
create	Create a new connection.
update	Update an existing connection.
share	Share connection with a Service Principal.
delete	Delete an existing connection.
show	Retrieve the connection ID from specific connection.
list	List all connections.

pac connection create

Usage: pac connection create [--name] [--username] [--password] [--applicationId] [--clientSecret] [--tenant] [--connectionType]

command	description
--name	The name you want to give to this connection (maximum 30 characters). (alias: -n)
--username	Optional: The username to authenticate with. (alias: -un)
--password	Optional: The password to authenticate with. (alias: -p)
--applicationId	Optional: The application ID to authenticate with. (alias: -id)
--clientSecret	Optional: The client secret to authenticate with. (alias: -cs)
--tenant	Tenant ID if using application ID/client secret. (alias: -t)
--connectionType	The type of the connection. E.g. Dataverse (alias: -ct)

Example: Named Create with Service Principal

pac connection create --name MyDataverseConn-SPN --applicationId 00000000-0000-0000-0000-000000000000 --clientSecret $clientSecret --tenant 00000000-0000-0000-0000-000000000000 --connectionType Dataverse

pac connection update

Usage: pac connection update [--name] [--username] [--password] [--applicationId] [--clientSecret] [--tenant]

command	description
--name	The connection's name or id that has to be updated. (alias: -n)
--username	Optional: The username to authenticate with. (alias: -un)
--password	Optional: The password to authenticate with. (alias: -p)
--applicationId	Optional: The application ID to authenticate with. (alias: -id)
--clientSecret	Optional: The client secret to authenticate with. (alias: -cs)
--tenant	Tenant ID if using application ID/client secret. (alias: -t)

Example: Update Connection with Service Principal

pac connection update --name MyDataverseConn-SPN --applicationId 00000000-0000-0000-0000-000000000000 --clientSecret $clientSecret --tenant 00000000-0000-0000-0000-000000000000

pac connection share

Usage: pac connection share [--name] [--servicePrincipal]

command	description
--name	The connection's name or id that has to be shared. (alias: -n)
--servicePrincipal	The service principal name or id to share with. (alias: -sp)

Example: Share Connection with Service Principal

pac connection share --name MyDataverseConn-SPN --servicePrincipal 00000000-0000-0000-0000-000000000000

pac connection delete

Usage: pac connection delete [--name]

command	description
--name	The connection's name or id that has to be deleted. (alias: -n)

Example: Delete Connection

pac connection delete --name MyDataverseConn-SPN

pac connection show

Usage: pac connection show [--name]

command	description
--name	The connection details that has to be retrieved. (alias: -n)

Example: Show Connection

pac connection show --name MyDataverseConn-SPN

The connection name, id, status, shared with, and type would be output.

pac connection list

Usage: pac connection list

This command doesn't take any arguments.

Further deep dives are encouraged.

[scottdurow]

Where can I give this +1000 upvotes? 😆

[petrochuk]

@jboliveira Thanks for very detailed suggestion

[troystaylor]

+1

[rajyraman]

I see connection related stuff in featureflags. Is this being worked on @petrochuk @kkanakas?

[petrochuk]

@rajyraman this discussion has highest number of votes so far. That means we are going to be looking at implementing some of these suggestions.

[petrochuk]

Sneak peek

Create Entra ID application
pac admin create-service-principal

and create connection using it
pac connection create

[Laskewitz]

Yesss! @jboliveira check this out! 🥳

[jboliveira]

That's awesome. Great work! Bravo👏🏽👏🏽 how can I test?

Btw, Is it possible to have get/update/delete commands as well?😍

[YannickRe]

@petrochuk This looks amazing! Will it allow me to authenticate with a Service Principal to create the connection? Or will this command require auth with a user to create the Connection?

If it is created by the SPN, it will also be owned by the SPN. If it requires user auth, the user will own it, in that case: will this command allow for sharing with an SPN after creation?

[petrochuk]

We will start with Dataverse connections using Service Principals and expand based on your feedback

[jboliveira]

It's looking fantastic! Thank you.

[StylezDevops]

@kkanakas @petrochuk
This is awesome and it is EXACTLY what I was talking about in the call we had back in July. Would be great to see this expanded to other connectors now... incredible work.

[petrochuk]

I'll close this item. I understand it is not yet complete, but we made enough progress and can treat any improvements as separate discussions with links to this one.

[fshin-ttecdigital]

@petrochuk does the pac connection update command support converting a connection to use a app registration service principal instead of a current user setup? I tried it out and it said it was successful but when I went to the UI to look at the connection, it didn't seem to be updated.