CXH-2166: implement PAT (workspace token) authentication #54
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -140,14 +140,82 @@ | |
| "defaultValue": "cloud.databricks.com" | ||
| } | ||
| }, | ||
| { | ||
| "name": "workspaces", | ||
| "displayName": "Workspaces", | ||
| "description": "Limit syncing to the specified workspaces, by deployment name, not workspace ID. Required when using workspace tokens, in the same order as workspace-tokens. Mutually exclusive with databricks-exclude-workspaces.", | ||
| "stringSliceField": {} | ||
| }, | ||
| { | ||
| "name": "workspace-tokens", | ||
| "displayName": "Workspace Tokens", | ||
| "description": "The Databricks personal access tokens scoped to specific workspaces used to connect to the Databricks Workspace API", | ||
| "isRequired": true, | ||
| "isSecret": true, | ||
| "stringSliceField": { | ||
| "rules": { | ||
| "isRequired": true | ||
| } | ||
| } | ||
| }, | ||
| { | ||
| "name": "databricks-exclude-workspaces", | ||
| "displayName": "Exclude Workspaces", | ||
| "description": "Workspaces to exclude from sync, identified by workspace name, deployment name, or numeric workspace ID. Mutually exclusive with workspaces.", | ||
| "stringSliceField": {} | ||
| } | ||
| ], | ||
| "constraints": [ | ||
| { | ||
| "kind": "CONSTRAINT_KIND_MUTUALLY_EXCLUSIVE", | ||
| "fieldNames": [ | ||
| "workspaces", | ||
| "databricks-exclude-workspaces" | ||
| ] | ||
| }, | ||
| { | ||
| "kind": "CONSTRAINT_KIND_DEPENDENT_ON", | ||
| "fieldNames": [ | ||
| "workspace-tokens" | ||
| ], | ||
| "secondaryFieldNames": [ | ||
| "workspaces" | ||
| ] | ||
| } | ||
| ], | ||
| "displayName": "Databricks", | ||
| "helpUrl": "/docs/baton/databricks", | ||
| "iconUrl": "/static/app-icons/databricks.svg", | ||
| "fieldGroups": [ | ||
| { | ||
| "name": "oauth2", | ||
| "displayName": "OAuth2", | ||
| "helpText": "Authenticate as a service principal using an OAuth2 client ID and secret.", | ||
| "fields": [ | ||
| "account-id", | ||
| "databricks-client-id", | ||
| "databricks-client-secret", | ||
| "hostname", | ||
| "account-hostname", | ||
| "workspaces", | ||
| "base-url", | ||
| "databricks-exclude-workspaces" | ||
| ], | ||
| "default": true | ||
| }, | ||
| { | ||
| "name": "workspace-token", | ||
| "displayName": "Workspace token", | ||
| "helpText": "Authenticate with a personal access token scoped to each workspace.", | ||
| "fields": [ | ||
| "account-id", | ||
| "workspaces", | ||
| "workspace-tokens", | ||
| "hostname", | ||
| "account-hostname", | ||
| "base-url", | ||
| "databricks-exclude-workspaces" | ||
| ] | ||
| } | ||
| ] | ||
|
Comment on lines
+189
to
+220
Contributor
There was a problem hiding this comment. 🟡 Suggestion: this generated artifact is stale relative to 🤖 via Claude Code |
||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
[Docs] Separate from this PR — "Username and password" auth is still documented but doesn't exist
Not something this PR needs to fix, but since you're already cleaning up the auth docs in this exact file: further up (README.md's "Bearer auth"/basic-auth paragraphs, around the intro section) this README still describes a third auth option — username/password ("Basic auth") — and there's genuinely zero implementation of it anywhere in the codebase (no
BasicAuthtype inpkg/databricks/auth.go, no username/password fields inpkg/config/config.go). Might be worth a follow-up to either implement it or drop the claim, since a customer following these docs for that option will configure something that silently doesn't exist.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I pulled the username/password bits from the README in this PR. databricks EOL'd basic auth back in 2024 and it was never implemented here, so the docs were just stale.
https://docs.databricks.com/aws/en/security/auth/password-deprecation