You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
azure-cli authentication method in Go SDK works differently compared to the original implementation. It works only when a user is already a part of the workspace, but fails when a user is a Contributor to the workspace, but not inside yet.
The reason for it is that Go SDK's azure-cli authentication method generates only Authorization header with AAD token for 2ff814a6-3304-4ab8-85cb-cd0e6f879c1d, but not adding additional headers like it was done in the version before Go SDK introduction.
User having a Contributor role should be able to perform operations.
Actual Behavior
user gets:
│ Error: User not authorized
│
│ with data.databricks_current_user.me,
│ on main.tf line 15, in data "databricks_current_user" "me":
│ 15: data "databricks_current_user" "me" {}
Steps to Reproduce
Terraform and provider versions
1.23.0 doesn't work
1.9.2 works (latest before Go SDK upgrade)
Debug Output
Important Factoids
The text was updated successfully, but these errors were encountered:
## Changes
The Go SDK request authentication logic is inconsistent between the
Azure login types: for service principal & MSI auth, the SDK correctly
adds the X-Databricks-Azure-Workspace-Resource-Id when configured, but
this is missed for Azure CLI auth. Additionally, when logging in via
Azure CLI using a service principal, the service management token must
also be fetched from the CLI. This caused a regression for the Terraform
provider:
databricks/terraform-provider-databricks#2590.
This PR fixes this by defining the logic to attach these header in a
common function that is used by all Azure-specific authentication types.
## Tests
- [x] Added a unit test to ensure the header is being set for Azure CLI
login
- [x] Made a test app that uses `azure-cli` to login and verified that
the correct header was set on the request:
```
...
> * X-Databricks-Azure-Workspace-Resource-Id: /subscriptions/<REDACTED>/resourceGroups/<REDACTED>/pr... (63 more bytes)
```
- [ ] `make test` passing
- [ ] `make fmt` applied
- [ ] relevant integration tests applied
azure-cli
authentication method in Go SDK works differently compared to the original implementation. It works only when a user is already a part of the workspace, but fails when a user is a Contributor to the workspace, but not inside yet.The reason for it is that Go SDK's
azure-cli
authentication method generates onlyAuthorization
header with AAD token for2ff814a6-3304-4ab8-85cb-cd0e6f879c1d
, but not adding additional headers like it was done in the version before Go SDK introduction.Configuration
Expected Behavior
User having a Contributor role should be able to perform operations.
Actual Behavior
user gets:
Steps to Reproduce
Terraform and provider versions
Debug Output
Important Factoids
The text was updated successfully, but these errors were encountered: