Uh oh!
There was an error while loading. Please reload this page.
Add host discovery to login.databricks.com flow - #4829
Merged
Conversation
simonfaltum
requested review from
andrewnester, anton-107, denik, pietern and shreyas-goenka
as code ownersMarch 24, 2026 15:25
hectorcast-db
approved these changes
Mar 25, 2026
The discovery login flow via login.databricks.com now calls runHostDiscovery() on the discovered host to populate account_id, workspace_id, and DiscoveryURL from .well-known/databricks-config. This ensures profiles created via login.databricks.com have the same SPOG metadata as profiles created via the regular --host login path. Previously, the discovery flow relied solely on token introspection for workspace_id and deliberately skipped saving account_id. With the SPOG discovery changes now in place, account_id can be safely saved to profiles. Token introspection remains as a fallback when host metadata discovery is unavailable (e.g. classic workspace hosts). Co-authored-by: Isaac
simonfaltumforce-pushed
the
simonfaltum/discovery-login-host-discovery
branch
from
March 26, 2026 22:01
3418b86 to
f92e226Comparesimonfaltumtemporarily deployed
to
test-trigger-is
March 26, 2026 22:01 — with 
GitHub Actions
Inactive
Collaborator
Commit: ca5ac25
17 interesting tests: 10 SKIP, 7 RECOVERED
Top 20 slowest tests (at least 2 minutes):
|
…ks.com The login.databricks.com flow now calls runHostDiscovery() on the discovered host, which populates workspace_id from .well-known and account_id from introspection as a fallback. Update the expected output to reflect both fields being saved to the profile. Co-authored-by: Isaac
simonfaltumtemporarily deployed
to
test-trigger-is
March 26, 2026 22:24 — with GitHub Actions
Inactive
simonfaltum
enabled auto-merge
March 26, 2026 22:30
Uh oh!
There was an error while loading. Please reload this page.
eng-dev-ecosystem-bot
commented
Mar 27, 2026
Collaborator
Commit: 10c3bf9
44 interesting tests: 19 RECOVERED, 10 FAIL, 8 flaky, 5 KNOWN, 2 SKIP
Top 50 slowest tests (at least 2 minutes):
|
denik pushed a commit
that referenced
this pull request
May 20, 2026
## Why The discovery login flow via `login.databricks.com` (PR #4702) is a separate code path from the regular `--host` login. After #4809 added SPOG host detection via `.well-known/databricks-config` to the regular login path, the discovery flow was missing this behavior. Profiles created via `login.databricks.com` for SPOG hosts had no `account_id` and no discovery metadata, which breaks re-authentication (because `ToOAuthArgument()` needs `account_id` to route to unified OAuth). ## Changes **Before:** `discoveryLogin()` only used token introspection for `workspace_id` and deliberately skipped saving `account_id`. **Now:** After getting the host from `login.databricks.com`, `discoveryLogin()` calls `runHostDiscovery()` on the discovered host to populate `account_id`, `workspace_id`, and `DiscoveryURL` from `.well-known/databricks-config`. Token introspection is kept as a fallback for hosts where discovery is unavailable (e.g. classic workspace hosts). `account_id` is now saved to the profile. **Note:** This is not the full SPOG story for discovery login. Most SPOG workspaces will need additional handling during the login.databricks.com flow (e.g. workspace selection after discovery detects a multi-workspace account). A follow-up PR will address this. ## Test plan - New test: discovery login with SPOG host (mock `.well-known/databricks-config`) verifies `account_id` and `workspace_id` come from discovery - New test: discovery login where host discovery fails verifies fallback to introspection - Updated existing tests to assert `account_id` is now saved - All `go test ./cmd/auth/... ./libs/auth/...` pass - `make checks` passes This pull request was AI-assisted by Isaac.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The discovery login flow via
login.databricks.com(PR #4702) is a separate code path from the regular--hostlogin. After #4809 added SPOG host detection via.well-known/databricks-configto the regular login path, the discovery flow was missing this behavior. Profiles created vialogin.databricks.comfor SPOG hosts had noaccount_idand no discovery metadata, which breaks re-authentication (becauseToOAuthArgument()needsaccount_idto route to unified OAuth).Changes
Before:
discoveryLogin()only used token introspection forworkspace_idand deliberately skipped savingaccount_id.Now: After getting the host from
login.databricks.com,discoveryLogin()callsrunHostDiscovery()on the discovered host to populateaccount_id,workspace_id, andDiscoveryURLfrom.well-known/databricks-config. Token introspection is kept as a fallback for hosts where discovery is unavailable (e.g. classic workspace hosts).account_idis now saved to the profile.Note: This is not the full SPOG story for discovery login. Most SPOG workspaces will need additional handling during the login.databricks.com flow (e.g. workspace selection after discovery detects a multi-workspace account). A follow-up PR will address this.
Test plan
.well-known/databricks-config) verifiesaccount_idandworkspace_idcome from discoveryaccount_idis now savedgo test ./cmd/auth/... ./libs/auth/...passmake checkspassesThis pull request was AI-assisted by Isaac.