[BUG] Unable to Create Connection with Basic Auth using Gateway

[BenjiFuse]

Bug Description

When attempting to create a connection with basic auth using a gateway name or id, I get this error: [InvalidInput] The request has an invalid input

fabric-cli version

1.1.0

Python version

3.12.7

Operating System

Windows

CLI Mode

Interactive mode

Authentication Method

Interactive browser login

Steps to Reproduce

fab create .connections/<name>.Connection -P connectivityType=OnPremesisGateway,gatewayId=<gatewayId>,connectionDetails.type=SQL,connectionDetails.parameters.server=<server>,connectionDetails.parameters.database=<database>,credentialDetails.type=Basic,credentialDetails.username=<username>,credentialDetails.password=<password>

Expected Behavior

The connection should be created.

Actual Behavior

Command output:

[InvalidInput] The request has an invalid input

Additional Context

No response

Possible Solution

No response

[BenjiFuse]

Per the Fabric REST API docs on creating connections it appears the credentials in this case need to be encrypted. That encryption doesn't seem to be implemented by the fabric cli, so I made an attempt at adding it:

I patched src\fabric_cli\commands\fs\mkdir\fab_fs_mkdir_connection.py to use the requested gateway's public key to encrypt and then base64 encode the provided basic credentials. I also patched src\fabric_cli\utils\fab_cmd_mkdir_utils.py to ensure the parameters get assembled correctly in the request. Here's an example snippet showing the patched connectionDetails format which now matches the API docs:

    "credentialDetails": {
        "credentials": {
            "credentialType": "Basic",
            "values": [
                {
                    "gatewayId": "<GATEWAY_ID>",
                    "encryptedCredentials": "<ENCRYPTED_CREDENTIALS>"
                }
            ]
        }
    },

This got me past the InvalidInput error, but now I'm getting an error from the downstream connection creation. Here's the actual response from the debug logs:

{
    "requestId": "cca6b68f-dd79-4e17-be00-b6809f5ed9cc",
    "errorCode": "CreateGatewayConnectionFailed",
    "moreDetails":
    [
        {
            "errorCode": "",
            "message": "{\"mygateway\":{\"error\":{\"code\":\"DM_GWPipeline_UnknownError\",\"pbi.error\":{\"code\":\"DM_GWPipeline_UnknownError\",\"parameters\":{},\"details\":[{\"code\":\"DM_ErrorDetailNameCode_UnderlyingErrorMessage\",\"detail\":{\"type\":1,\"value\":\"expecting atleast 66 bytes of key\"}},{\"code\":\"DM_ErrorDetailNameCode_UnderlyingHResult\",\"detail\":{\"type\":1,\"value\":\"-2146233296\"}}],\"exceptionCulprit\":1}}}}"
        }
    ],
    "message": "Failed to create gateway connection"
}

By supplying a much longer password I get a different error detailed in the debug logs:

{
    "requestId": "88e130b7-ca3f-4de9-af9e-e466cc137054",
    "errorCode": "CreateGatewayConnectionFailed",
    "moreDetails":
    [
        {
            "errorCode": "",
            "message": "{\"mygateway\":{\"error\":{\"code\":\"DM_GWPipeline_UnknownError\",\"pbi.error\":{\"code\":\"DM_GWPipeline_UnknownError\",\"parameters\":{},\"details\":[{\"code\":\"DM_ErrorDetailNameCode_UnderlyingErrorMessage\",\"detail\":{\"type\":1,\"value\":\"UnSupported key length, 123\\r\\nParameter name: keyLengths\"}},{\"code\":\"DM_ErrorDetailNameCode_UnderlyingHResult\",\"detail\":{\"type\":1,\"value\":\"-2147024809\"}}],\"exceptionCulprit\":1}}}}"
        }
    ],
    "message": "Failed to create gateway connection"
}

[aviatco]

/triaged

[microsoft-github-policy-service]

Triage has been completed for this issue.

[aviatco]

Hi BenjiFuse,
Thank you for reporting this issue.
We identified a gap in the CLI functionality: it currently does not support providing encryptedCredentials, which is available through the API.
We are addressing this by adding support for creating a connection with the on-premises gateway using encrypted credentials (PR).
The pull request also includes details on how to create this type of connection and the required parameters.