Add support for OIDC ID token authentication using an environment variable. #1215
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
renaudhartert-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
renaudhartert-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
renaudhartert-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
renaudhartert-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
renaudhartert-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
renaudhartert-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
renaudhartert-db
changed the title
renaudhartert-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
renaudhartert-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
renaudhartert-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
renaudhartert-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
renaudhartert-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
| @@ -108,6 +108,9 @@ type Config struct { | |||
| // specified by this argument. This argument also holds currently selected auth. | |||
| AuthType string `name:"auth_type" env:"DATABRICKS_AUTH_TYPE" auth:"-"` | |||
|
|
|||
| // Environment variable name that contains an OIDC ID token. | |||
| OIDCTokenEnv string `name:"oidc_token_env" env:"DATABRICKS_OIDC_TOKEN_ENV" auth:"-"` | |||
There was a problem hiding this comment.
Does it make sense to read this dynamically from the environment to support "refreshes"?
Note that neither AWS, GCP or Azure seem to support the refresh.
There was a problem hiding this comment.
The actual environment variable referred to by this environment variable is read each time the IDTokenSource is called. I'm not sure it's worth also reading this one dynamically.
There was a problem hiding this comment.
True. I missread this as if DATABRICKS_OIDC_TOKEN_ENV itself was the token.
renaudhartert-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
renaudhartert-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
|
If integration tests don't run automatically, an authorized user can run them manually by following the instructions below: Trigger: Inputs:
Checks will be approved automatically on success. |
hectorcast-db
approved these changes
May 6, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What changes are proposed in this pull request?
This PR adds a new way to authenticate by reading OIDC ID tokens from environment variables. By default, the new credential strategy attempts to read the token from
DATABRICKS_OIDC_TOKEN. This default value can be overwritten by settingDATABRICKS_OIDC_TOKEN_ENV.The new authentication mode will be tested before Github OIDC. The rationale is that we consider setting up
DATABRICKS_OIDC_TOKENas a stronger signal of intent than enabling OIDC for the whole Github Action.This PR also moves
IDTokenSourcein its ownoidcpackage within theexperimental/authpackage to clarify that these interfaces are still being validated.How is this tested?
Complete test coverage of the new source.