Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Add Token Federation Support for Databricks SQL Python Driver#691

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Merged
madhav-db merged 7 commits intomainfromtoken-federation-new
Sep 26, 2025

Conversation

@madhav-db
Copy link
Contributor

@madhav-dbmadhav-db commentedSep 5, 2025•
edited
Loading

What type of PR is this?

  • Refactor
  • Feature
  • Bug Fix
  • Other

Description

This PR implements token federation functionality for the databricks-sql-python driver, enabling seamless integration with external Identity Providers (IdPs) like Azure AD, Okta, and others.
Token federation allows users to authenticate with external IdPs and automatically exchange those tokens for Databricks in-house tokens when needed. This enables:

  • Workflow-Wide (M2M) Token Federation: Service principal authentication with external IdPs
  • Account-Wide (U2M) Token Federation: User authentication through external IdPs

Flow:

  1. Token Analysis: Checks if the external token's issuer differs from the Databricks host
  2. Automatic Exchange: If different, exchanges the token via /oidc/v1/token endpoint using OAuth 2.0 token exchange flow
  3. Caching: Caches exchanged tokens until expiry
  4. Fallback: Uses the original external token if exchange fails

How is this tested?

  • Unit tests
  • E2E Tests
  • Manually
  • N/A

Extensive testing was performed covering:

  1. M2M (Machine-to-Machine) Token Federation
    - External service principal tokens from Azure AD
    - Automatic token exchange with Databricks workspace
    - Authentication as service principal in Databricks
  2. U2M (User-to-Machine) Token Federation
    - Browser-based OAuth flow with automatic token handling
    - Pre-obtained user tokens from external IdPs
    - Authentication as actual users in Databricks
  3. Token Lifecycle Management
    - Token caching with proper expiry handling
    - Automatic refresh when tokens expire
    - Graceful fallback when exchange fails
  4. Cross-Cloud Compatibility
    - Tested with GCP Databricks workspace using Azure AD tokens
    - Tested with Azure Databricks workspace
    - Verified issuer-based exchange decision logic

Related Tickets & Documents

@github-actions
Copy link

Thanks for your contribution! To satisfy the DCO policy in ourcontributing guide every commit message must include a sign-off message. One or more of your commits is missing this message. You can reword previous commit messages with an interactive rebase (git rebase -i main).

@madhav-dbmadhav-db changed the titleToken federation for python driverAdd Token Federation Support for Databricks SQL Python DriverSep 8, 2025
@github-actions
Copy link

Thanks for your contribution! To satisfy the DCO policy in ourcontributing guide every commit message must include a sign-off message. One or more of your commits is missing this message. You can reword previous commit messages with an interactive rebase (git rebase -i main).

@github-actions
Copy link

Thanks for your contribution! To satisfy the DCO policy in ourcontributing guide every commit message must include a sign-off message. One or more of your commits is missing this message. You can reword previous commit messages with an interactive rebase (git rebase -i main).

@github-actions
Copy link

Thanks for your contribution! To satisfy the DCO policy in ourcontributing guide every commit message must include a sign-off message. One or more of your commits is missing this message. You can reword previous commit messages with an interactive rebase (git rebase -i main).

@github-actions
Copy link

Thanks for your contribution! To satisfy the DCO policy in ourcontributing guide every commit message must include a sign-off message. One or more of your commits is missing this message. You can reword previous commit messages with an interactive rebase (git rebase -i main).

Copy link
Contributor

@jprakash-dbjprakash-db left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

LGTM. Thanks for making the changes

@github-actions
Copy link

Thanks for your contribution! To satisfy the DCO policy in ourcontributing guide every commit message must include a sign-off message. One or more of your commits is missing this message. You can reword previous commit messages with an interactive rebase (git rebase -i main).

@github-actions
Copy link

Thanks for your contribution! To satisfy the DCO policy in ourcontributing guide every commit message must include a sign-off message. One or more of your commits is missing this message. You can reword previous commit messages with an interactive rebase (git rebase -i main).

@madhav-dbmadhav-db merged commitf835aca intomainSep 26, 2025
29 of 30 checks passed
Sign up for freeto join this conversation on GitHub. Already have an account?Sign in to comment

Reviewers

@jprakash-dbjprakash-dbjprakash-db approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@madhav-db@jprakash-db
[8]ページ先頭
©2009-2025 Movatter.jp