Determine what user is the data refresh account configured by the administrator

Question

Is there a way to get the username that is set as the data refresh account for a power pivot installation?

I realize this user is set in the secure store service application but I can't seem to find a way to retrieve what user it is.

Answer 1

There is not easy way to get this information. The only option is to use PowerShell or ServerSide API's.

Use below powershell script to list all SSO details

$serviceCntx = Get-SPServiceContext -Site http://server
$sssProvider = New-Object Microsoft.Office.SecureStoreService.Server.SecureStoreProvider
$sssProvider.Context = $serviceCntx
$marshal = [System.Runtime.InteropServices.Marshal]
try
{
    $applicationlications = $sssProvider.GetTargetApplications()
    foreach ($application in $applicationlications)
    {
        Write-Output "$($application.Name)"
        Write-Output "$('-'*100)"
        try
        {
            $sssCreds = $sssProvider.GetCredentials($application.Name)
            foreach ($sssCred in $sssCreds)
            {
                $ptr = $marshal::SecureStringToBSTR($sssCred.Credential)
                $str = $marshal::PtrToStringBSTR($ptr)
                Write-Output "$($sssCred.CredentialType): $($str)"
            }
        }
        catch
        {
            Write-Output "(Something went wrong) - Error getting credentials!"
        }   
        Write-Output "$('-'*100)"
    }
}
catch
{
    Write-Output "(Something went wrong) - Error getting Target Applications."
}
$marshal::ZeroFreeBSTR($ptr)

Answer 2

It can be retrieved using the Secure Store API:

Powershell

Source: Get More Out of Your Secure Store Service via PowerShell and C#

function Get-CredentialsFromSecureStore
{
    [CmdletBinding()]
    Param
    (
        [Parameter(Mandatory=$true)][string]$contextSiteUrl,
        [Parameter(Mandatory=$true)][string]$ssTargetAppName
    )
    $ErrorActionPreference = "Stop"
    Write-Debug "$($MyInvocation.MyCommand.Name): Begin"

    Write-Verbose "$($MyInvocation.MyCommand.Name): Getting the Secure Store Provider from ""$contextSiteUrl"""
    $ssp = Get-SecureStoreProvider -contextSiteUrl $contextSiteUrl

    Write-Verbose "$($MyInvocation.MyCommand.Name): Getting the Credentials for Secure Store Target Application ""$ssTargetAppName"""
    [Microsoft.BusinessData.Infrastructure.SecureStore.SecureStoreCredentialCollection]$ssCreds = $ssp.GetCredentials($ssTargetAppName)

    Write-Debug "$($MyInvocation.MyCommand.Name): End"
    return $ssCreds
}

C#

Source: MSDN

private void ReadCredentialsFromSecureStore() 
{ 
    // Error checking removed for brevity. 
    string targetId = 
        LobSystemInstance.GetProperties()["SecondarySsoApplicationId"]  
        as string; 
    ISecureStoreProvider provider = GetSecureStoreProvider();
    // Get the credentials for the user on whose behalf the code 
    // is executing. 
    using(SecureStoreCredentialCollection credentials =      
        provider.GetRestrictedCredentials(targetId)) 
    { 
        SecureString secureUsername; 
        SecureString securePassword; 
         // Look for username and password in credentials. 
        foreach (ISecureStoreCredential credential in credentials) 
        { 
            switch (credential.CredentialType) 
            { 
                case SecureStoreCredentialType.UserName: 
                case SecureStoreCredentialType.WindowsUserName: 
                    secureUsername = credential.Credential; 
                    break; 
                case SecureStoreCredentialType.Password: 
                case SecureStoreCredentialType.WindowsPassword: 
                    securePassword = credential.Credential; 
                    break; 
                default: 
                    break; 
            } 
        } 
        // Username and password have been read. 
        // Use them as necessary.  
    } 
     // NOTE:  Because we are getting the credentials in the using block,  
    // all the credentials that we get will be disposed after the 
    // using block. If you need to cache the credentials,  do not use 
    // a using block but dispose the credentials when you are done 
     // with them.
}