ADF Google Ads Linked Service using Service Authentication as the Authentication Type ERROR pkcs8PrivateKey

mamadou bhoye sow 30

Trying to access Google Ads data using a Google Ads Service Account, and the ADF Google Ads Linked Service. The linked service "Authentication type" set to "Service authentication". We generated a private key for this Service Account in Google, and we have used the key as the value in the "Private key" field of the linked service. We have populated the other required linked service fields (Name, Client customer ID, Developer token, Email), and also the optional "Login customer ID" field. We have also designated the linked service to use a self-hosted integration runtime instead of the AutoResolveIntegrationRuntime.

Point here:
the private key is a valid too and we tested its validity using openssl
-----BEGIN PRIVATE KEY-----

MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC...

-----END PRIVATE KEY-----

When testing the connection, we are receiving this error message:

The error said we the parameter is empty looks like the google ads connector ui is not recognizing the content of the private key.

Test connection operation failed.
Failed to open the database connection.
Fail to read from Google Ads.
Parameter was empty Parameter name: pkcs8PrivateKey

Any help from Microsoft?

Ganesh Gurram 4,965 Reputation points Microsoft External Staff

2025-03-05T03:10:13.34+00:00
Hi @mamadou bhoye sow

Thank you for posting your query!

The error message you are encountering, "Parameter was empty Parameter name: pkcs8PrivateKey," suggests that the Google Ads connector is not recognizing the private key you provided.

Here are some steps you can take to troubleshoot this issue:

Verify the Private Key Format - Ensure that the private key you are using is in the correct PKCS#8 format. The key should start with -----BEGIN PRIVATE KEY----- and end with -----END PRIVATE KEY-----. If the key is in a different format (like PKCS#1), you may need to convert it.

Check for Extra Characters - Make sure there are no extra spaces or new lines before or after the private key content. Any additional characters can cause the connector to fail to read the key properly.

Use SecureString - If you haven't already, consider marking the private key field as a SecureString. This can help with securely storing and retrieving the key.

Permissions - Ensure that the self-hosted integration runtime has the necessary permissions to access the private key. You may need to adjust the permissions for the private key to allow access from the service account used by the integration runtime.

Test with a Different Key - If possible, try generating a new private key for the service account and see if the issue persists with the new key.

For more details refer:

Troubleshoot the Google Ads connector in Azure Data Factory and Azure Synapse

Linked service properties

Hope this helps. Do let us know if you have any further queries.
mamadou bhoye sow 30 Reputation points

2025-03-05T16:47:15.9066667+00:00
I did the first 2 points you mentioned above but it is not working.
The key is valid since I used a python script to retrieve data from google.
step 1: valid the key using this command

openssl pkcs8 -topk8 -inform PEM -in private-key.pem -outform PEM -nocrypt -out private-key-pkcs8.pem

Remove all spaces between in the private key.
First tested this one:

Can you Ganesh Gurram verify it at your end?
mamadou bhoye sow 30 Reputation points

2025-03-05T16:56:06.85+00:00
I have validated and removed the spaces but it is still not working.
Validate the key by using openssl

openssl pkcs8 -topk8 -inform PEM -in private-key.pem -outform PEM -nocrypt -out private-key-pkcs8.pem

Remove spaces:

The private key value string doesn't have a space.

added spaces between KEY---- and the content of key string value like this.

Can you verify with a set up, seems like I am not the only who is facing this issue?
Terry Shelton 0 Reputation points

2025-03-06T20:47:33.51+00:00

mamadou bhoye sow Do you have any additional information about this issue? Have you tried generating a client id, client secret and refresh token for the Google Ads API, and using User Authentication as the linked service authentication type?
mamadou bhoye sow 30 Reputation points

2025-03-07T14:59:49.7566667+00:00

@Terry Shelton
Do you have any additional information about this issue?
I am using service authentication with all the all the google ads information.
I am able to read the data using python script but in our case we are using azure data factory with Google ADS Connector. It is not working.
Rakesh Govindula 95 Reputation points Microsoft External Staff

2025-03-11T05:59:43.4333333+00:00

Hi @Anonymous ,

Can you provide information about what kind of service authentication are you using? Are you using any using the legacy driver version for Service authentication?

If you are trying normal Service authentication, can you try with key stored in a Key Vault and let the copy activity pull from there when performing data copy.
mamadou bhoye sow 30 Reputation points

2025-03-11T18:55:38.45+00:00
@Terry Shelton @Anonymous
The issue was solved by setting up an self hosted integration runtime. Created a linked service with google ads connector with all the required credentials. The private key need need to be PKCS#8 and should not contains space between the headers. For the private key follows the response of @Ganesh Gurram

-----BEGIN PRIVATE KEY-----Masdfasdfasdfadsfadfadsfadsfasdf....kajdfakasdfa-----END PRIVATE KEY-----
Terry Shelton 0 Reputation points

2025-03-12T14:17:10.2733333+00:00

@Anonymous I am trying to use a self hosted IR as you have done. I created the SHIR (ir-SelfHostedOnAzureVM-1) on an Azure Virtual Machine, and I see it associated with my data factory when I am looking at the Monitor Integration runtimes as seen here:

However, I do not see it listed in the list of the Manage Integration runtimes as seen here:

Also, when creating a new Google Ads linked service, the SHIR is not listed as seen here:

Were you able to see the SHIR you used as a selection when you were creating your Google Ads linked service in ADF? Did you have to do anything specific to make the SHIR visible when creating the Google Ads linked service?
mamadou bhoye sow 30 Reputation points

2025-03-12T15:02:51.54+00:00

@Terry Shelton

Yes, I was able to see the self hosted integration runtime in the ADF and the google ads connector UI.
The self hosted integration needs to be associated with the provisioned virtual machine using the key generated in the SHIR Edit Integration runtime UI. The state need to be running to be able to see it in the google ads connector dropdown. If there are issues please verify the ADF networking configuration i.e. private endpoint, public endpoint, firewall and the virtual machine as self hosted IR.
https://www.microsoft.com/en-us/download/details.aspx?id=39717&hss_channel=lcp-1051674&msockid=2b28280517de609c06be3d68167461fe

https://learn.microsoft.com/en-us/azure/data-factory/self-hosted-integration-runtime-troubleshoot-guide?tabs=data-factory#self-hosted-ir-connectivity-issues

Accepted answer

AnnuKumari-MSFT 34,351 Reputation points Microsoft Employee

2025-03-12T10:04:52.18+00:00

mamadou bhoye sow ,

Glad that you figured out the way to resolve your issue and thank you for posting your solution so that others experiencing the same thing can easily reference this! Since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others ", I'll repost your solution in case you'd like to "Accept " the answer.

The issue was solved by setting up an self hosted integration runtime. Created a linked service with google ads connector with all the required credentials. The private key need need to be PKCS#8 and should not contains space between the headers.

For the private key , follow the below command:

-----BEGIN PRIVATE KEY-----Masdfasdfasdfadsfadfadsfadsfasdf....kajdfakasdfa-----END PRIVATE KEY---

Kindly accept the answer by clicking on Accept answer button so that the solution reaches the community in case anyone is facing similar issue. Thankyou.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

ADF Google Ads Linked Service using Service Authentication as the Authentication Type ERROR pkcs8PrivateKey

0 additional answers

Your answer