Add host discovery to login.databricks.com flow#4829
Merged
simonfaltum merged 2 commits intomainfrom Mar 26, 2026
Merged
Conversation
simonfaltum
requested review from
andrewnester,
anton-107,
denik,
pietern and
shreyas-goenka
as code owners
hectorcast-db
approved these changes
Mar 25, 2026
The discovery login flow via login.databricks.com now calls runHostDiscovery() on the discovered host to populate account_id, workspace_id, and DiscoveryURL from .well-known/databricks-config. This ensures profiles created via login.databricks.com have the same SPOG metadata as profiles created via the regular --host login path. Previously, the discovery flow relied solely on token introspection for workspace_id and deliberately skipped saving account_id. With the SPOG discovery changes now in place, account_id can be safely saved to profiles. Token introspection remains as a fallback when host metadata discovery is unavailable (e.g. classic workspace hosts). Co-authored-by: Isaac
simonfaltum
force-pushed
the
simonfaltum/discovery-login-host-discovery
branch
from
3418b86 to
f92e226
Compare
simonfaltum
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
Collaborator
|
Commit: ca5ac25
17 interesting tests: 10 SKIP, 7 RECOVERED
Top 20 slowest tests (at least 2 minutes):
|
…ks.com The login.databricks.com flow now calls runHostDiscovery() on the discovered host, which populates workspace_id from .well-known and account_id from introspection as a fallback. Update the expected output to reflect both fields being saved to the profile. Co-authored-by: Isaac
simonfaltum
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
Collaborator
|
Commit: 10c3bf9
44 interesting tests: 19 RECOVERED, 10 FAIL, 8 flaky, 5 KNOWN, 2 SKIP
Top 50 slowest tests (at least 2 minutes):
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The discovery login flow via
login.databricks.com(PR #4702) is a separate code path from the regular--hostlogin. After #4809 added SPOG host detection via.well-known/databricks-configto the regular login path, the discovery flow was missing this behavior. Profiles created vialogin.databricks.comfor SPOG hosts had noaccount_idand no discovery metadata, which breaks re-authentication (becauseToOAuthArgument()needsaccount_idto route to unified OAuth).Changes
Before:
discoveryLogin()only used token introspection forworkspace_idand deliberately skipped savingaccount_id.Now: After getting the host from
login.databricks.com,discoveryLogin()callsrunHostDiscovery()on the discovered host to populateaccount_id,workspace_id, andDiscoveryURLfrom.well-known/databricks-config. Token introspection is kept as a fallback for hosts where discovery is unavailable (e.g. classic workspace hosts).account_idis now saved to the profile.Note: This is not the full SPOG story for discovery login. Most SPOG workspaces will need additional handling during the login.databricks.com flow (e.g. workspace selection after discovery detects a multi-workspace account). A follow-up PR will address this.
Test plan
.well-known/databricks-config) verifiesaccount_idandworkspace_idcome from discoveryaccount_idis now savedgo test ./cmd/auth/... ./libs/auth/...passmake checkspassesThis pull request was AI-assisted by Isaac.