Skip to content

Tell AI agents to pass the device code login on to the user - #7235

Open
maksim-zuev-db wants to merge 1 commit into
device-code-agent-loginfrom
device-code-agent-notes
Open

maksim-zuev-db wants to merge 1 commit into
device-code-agent-loginfrom
device-code-agent-notes

Conversation

@maksim-zuev-db

Copy link
Copy Markdown
Member

Stacked on #7220.

Changes

When an AI agent is detected (useragent.AgentProvider()), the first step of the non-interactive device code login also prints notes that tell the agent to give the URL and the code to the user, not to open the URL or approve the login itself, and to ask the user for the confirmation code. Agent detection does not change the flow.

Why

The login must be approved by the user, but an agent that runs it gets the URL and the code and could try to approve it itself, or not pass it on. Split out of #7220 to keep that PR smaller.

Tests

The device-code/non-interactive/nominal acceptance test runs both steps with AGENT set.

This pull request and its description were written by Isaac.

An AI agent that runs the non-interactive device code login gets the URL and
the user code, but the login must be approved by the user. When an agent is
detected, the first step also prints notes that tell it to give the URL and
the code to the user, not to approve the login itself, and to ask the user
for the confirmation code. Agent detection does not change the flow.

Co-authored-by: Isaac <no-reply@databricks.com>
@github-actions

Copy link
Copy Markdown
Contributor

Commit: 6636d4c1b | Workflow run

Regression test report

Selected 5 changed tests (limit=20, 0 not selected)

5 tests: regression=5 unreleased=0 coverage=0 failing=0

test branch main (d27fd75) latest (v1.22.1)
TestAccept/cmd/auth/login/device-code/non-interactive/concurrent ✅ ❌ ❌
TestAccept/cmd/auth/login/device-code/non-interactive/errors ✅ ❌ ❌
TestAccept/cmd/auth/login/device-code/non-interactive/flags ✅ ❌ ❌
TestAccept/cmd/auth/login/device-code/non-interactive/nominal ✅ ❌ ❌
TestAccept/cmd/auth/login/device-code/unsupported-host ✅ ❌ ❌
TestAccept/cmd/auth/login/device-code/non-interactive/concurrent: branch ✅ | main (d27fd75) ❌ | latest (v1.22.1) ❌

main (d27fd75):

acceptance_test.go:1341: Diff:
        --- cmd/auth/login/device-code/non-interactive/concurrent/output.txt
        +++ /tmp/TestAcceptcmdauthlogindevice-codenon-interactiveconcurrent560604621/002/output.txt
        @@ -3,58 +3,4 @@
         
         >>> [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code
         
        ->>> [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code
        -
        ->>> update_file.py home/.databricks/token-cache.json WDJBMJHT NEWRCODE
        -
        ->>> cache_keys
        -[
        -  "test#device-code"
        -]
        -
        ->>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
        -Error: a newer login for profile test replaced this one. Complete the newer login with its user code. Run the same command without --user-code and --confirmation-code to start a new login
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code NEWR-CODE --confirmation-code FTFA-QQKY
        -Profile test was successfully saved
        -
        ->>> print_requests.py --oneline //oidc/v1/token
        -{"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=device-code-2&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
        -
        -=== Logins for different targets are independent
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --profile a --use-device-code
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --profile b --use-device-code
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --use-device-code
        -
        ->>> cache_keys
        -[
        -  "a#device-code",
        -  "b#device-code",
        -  "[DATABRICKS_URL]",
        -  "[DATABRICKS_URL]#device-code",
        -  "test"
        -]
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --profile b --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
        -Profile b was successfully saved
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --profile a --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
        -Profile a was successfully saved
        -
        ->>> cache_keys
        -[
        -  "a",
        -  "b",
        -  "[DATABRICKS_URL]",
        -  "test"
        -]
        -
        ->>> print_requests.py --oneline //oidc/v1/token
        -{"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=device-code-4&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
        -{"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=device-code-5&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
        -{"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=device-code-3&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
        +Exit code: 1
        
    acceptance_test.go:1119: 
        LOG.first: Using a browser on another device, visit:
        LOG.first: http://127.0.0.1:34331/device/verification
        LOG.first: 
        LOG.first: And enter the code:
        LOG.first: WDJB-MJHT
        LOG.first: 
        LOG.first: Once finished, enter the confirmation code provided in your browser.
        LOG.first: Confirmation code: Error: reading confirmation code: EOF

latest (v1.22.1):

acceptance_test.go:1341: Diff:
        --- cmd/auth/login/device-code/non-interactive/concurrent/output.txt
        +++ /tmp/TestAcceptcmdauthlogindevice-codenon-interactiveconcurrent859746926/002/output.txt
        @@ -3,58 +3,4 @@
         
         >>> [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code
         
        ->>> [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code
        -
        ->>> update_file.py home/.databricks/token-cache.json WDJBMJHT NEWRCODE
        -
        ->>> cache_keys
        -[
        -  "test#device-code"
        -]
        -
        ->>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
        -Error: a newer login for profile test replaced this one. Complete the newer login with its user code. Run the same command without --user-code and --confirmation-code to start a new login
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code NEWR-CODE --confirmation-code FTFA-QQKY
        -Profile test was successfully saved
        -
        ->>> print_requests.py --oneline //oidc/v1/token
        -{"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=device-code-2&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
        -
        -=== Logins for different targets are independent
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --profile a --use-device-code
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --profile b --use-device-code
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --use-device-code
        -
        ->>> cache_keys
        -[
        -  "a#device-code",
        -  "b#device-code",
        -  "[DATABRICKS_URL]",
        -  "[DATABRICKS_URL]#device-code",
        -  "test"
        -]
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --profile b --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
        -Profile b was successfully saved
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --profile a --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
        -Profile a was successfully saved
        -
        ->>> cache_keys
        -[
        -  "a",
        -  "b",
        -  "[DATABRICKS_URL]",
        -  "test"
        -]
        -
        ->>> print_requests.py --oneline //oidc/v1/token
        -{"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=device-code-4&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
        -{"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=device-code-5&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
        -{"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=device-code-3&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
        +Exit code: 1
        
    acceptance_test.go:1119: 
        LOG.first: Error: unknown flag: --use-device-code
        LOG.first: 
        LOG.first: Usage:
        LOG.first:   databricks auth login [PROFILE] [flags]
        LOG.first: 
        LOG.first: Flags:
        LOG.first:       --client-id string       OAuth client ID to use for U2M authentication
        LOG.first:       --configure-cluster      Prompts to configure cluster
        LOG.first:       --configure-serverless   Prompts to configure serverless
        LOG.first:   -h, --help                   help for login
        LOG.first:       --resource stringArray   RFC 8707 resource indicator to scope the login to (repeatable). Requires --host.
        LOG.first:       --scopes string          Comma-separated list of OAuth scopes to request (defaults to 'all-apis')
        LOG.first:       --skip-workspace         Skip workspace selection for account-level access
        LOG.first:       --timeout duration       Timeout for completing login challenge in the browser (default 1h0m0s)
        LOG.first: 
        LOG.first: Global Flags:
        LOG.first:       --account-id string     Databricks Account ID
        LOG.first:       --debug                 enable debug logging
        LOG.first:       --host string           Databricks Host
        LOG.first:   -o, --output type           output type: text or json (default text)
        LOG.first:   -p, --profile string        ~/.databrickscfg profile
        LOG.first:   -t, --target string         bundle target to use (if applicable)
        LOG.first:       --workspace-id string   Databricks Workspace ID
TestAccept/cmd/auth/login/device-code/non-interactive/errors: branch ✅ | main (d27fd75) ❌ | latest (v1.22.1) ❌

main (d27fd75):

acceptance_test.go:1341: Diff:
        --- cmd/auth/login/device-code/non-interactive/errors/output.txt
        +++ /tmp/TestAcceptcmdauthlogindevice-codenon-interactiveerrors2477268701/002/output.txt
        @@ -5,86 +5,264 @@
         Error: --use-device-code is experimental. Set DATABRICKS_CLI_DEVICE_CODE=true to enable it
         
         >>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
        -Error: --use-device-code is experimental. Set DATABRICKS_CLI_DEVICE_CODE=true to enable it
        +Error: unknown flag: --user-code
         
        +Usage:
        +  databricks auth login [PROFILE] [flags]
        +
        +Flags:
        +      --client-id string       OAuth client ID to use for U2M authentication
        +      --configure-cluster      Prompts to configure cluster
        +      --configure-serverless   Prompts to configure serverless
        +  -h, --help                   help for login
        +      --resource stringArray   RFC 8707 resource indicator to scope the login to (repeatable). Requires --host.
        +      --scopes string          Comma-separated list of OAuth scopes to request (defaults to 'all-apis')
        +      --skip-workspace         Skip workspace selection for account-level access
        +      --timeout duration       Timeout for completing login challenge in the browser (default 1h0m0s)
        +
        +Global Flags:
        +      --account-id string     Databricks Account ID
        +      --debug                 enable debug logging
        +      --host string           Databricks Host
        +  -o, --output type           output type: text or json (default text)
        +  -p, --profile string        ~/.databrickscfg profile
        +  -t, --target string         bundle target to use (if applicable)
        +      --workspace-id string   Databricks Workspace ID
        +
        +
         === Flags the non-interactive login cannot honor
         
         >>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --configure-cluster
        -Error: --configure-cluster is not supported by the non-interactive device code login. Set cluster_id on the profile after the login
        +Using a browser on another device, visit:
        +[DATABRICKS_URL]/device/verification
         
        +And enter the code:
        +WDJB-MJHT
        +
        +Once finished, enter the confirmation code provided in your browser.
        +Confirmation code: Error: reading confirmation code: EOF
        +
         === Missing host
         
         >>> musterr [CLI] auth login --use-device-code
        -Error: --use-device-code requires a workspace host. Pass it as an argument or with --host
        +Error: the command is being run in a non-interactive environment, please specify a host using --host
         
         >>> musterr [CLI] auth login --profile test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
        -Error: --use-device-code requires a workspace host. Pass it as an argument or with --host
        +Error: unknown flag: --user-code
         
        +Usage:
        +  databricks auth login [PROFILE] [flags]
        +
        +Flags:
        +      --client-id string       OAuth client ID to use for U2M authentication
        +      --configure-cluster      Prompts to configure cluster
        +      --configure-serverless   Prompts to configure serverless
        +  -h, --help                   help for login
        +      --resource stringArray   RFC 8707 resource indicator to scope the login to (repeatable). Requires --host.
        +      --scopes string          Comma-separated list of OAuth scopes to request (defaults to 'all-apis')
        +      --skip-workspace         Skip workspace selection for account-level access
        +      --timeout duration       Timeout for completing login challenge in the browser (default 1h0m0s)
        +
        +Global Flags:
        +      --account-id string     Databricks Account ID
        +      --debug                 enable debug logging
        +      --host string           Databricks Host
        +  -o, --output type           output type: text or json (default text)
        +  -p, --profile string        ~/.databrickscfg profile
        +  -t, --target string         bundle target to use (if applicable)
        +      --workspace-id string   Databricks Workspace ID
        +
        +
         === Incomplete flags of the second step
         
         >>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --confirmation-code FTFA-QQKY
        -Error: --confirmation-code requires --user-code
        +Error: unknown flag: --confirmation-code
         
        +Usage:
        +  databricks auth login [PROFILE] [flags]
        +
        +Flags:
        +      --client-id string       OAuth client ID to use for U2M authentication
        +      --configure-cluster      Prompts to configure cluster
        +      --configure-serverless   Prompts to configure serverless
        +  -h, --help                   help for login
        +      --resource stringArray   RFC 8707 resource indicator to scope the login to (repeatable). Requires --host.
        +      --scopes string          Comma-separated list of OAuth scopes to request (defaults to 'all-apis')
        +      --skip-workspace         Skip workspace selection for account-level access
        +      --timeout duration       Timeout for completing login challenge in the browser (default 1h0m0s)
        +
        +Global Flags:
        +      --account-id string     Databricks Account ID
        +      --debug                 enable debug logging
        +      --host string           Databricks Host
        +  -o, --output type           output type: text or json (default text)
        +  -p, --profile string        ~/.databrickscfg profile
        +  -t, --target string         bundle target to use (if applicable)
        +      --workspace-id string   Databricks Workspace ID
        +
        +
         >>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code WDJB-MJHT
        -Error: --user-code requires --confirmation-code
        +Error: unknown flag: --user-code
         
        +Usage:
        +  databricks auth login [PROFILE] [flags]
        +
        +Flags:
        +      --client-id string       OAuth client ID to use for U2M authentication
        +      --configure-cluster      Prompts to configure cluster
        +      --configure-serverless   Prompts to configure serverless
        +  -h, --help                   help for login
        +      --resource stringArray   RFC 8707 resource indicator to scope the login to (repeatable). Requires --host.
        +      --scopes string          Comma-separated list of OAuth scopes to request (defaults to 'all-apis')
        +      --skip-workspace         Skip workspace selection for account-level access
        +      --timeout duration       Timeout for completing login challenge in the browser (default 1h0m0s)
        +
        +Global Flags:
        +      --account-id string     Databricks Account ID
        +      --debug                 enable debug logging
        +      --host string           Databricks Host
        +  -o, --output type           output type: text or json (default text)
        +  -p, --profile string        ~/.databrickscfg profile
        +  -t, --target string         bundle target to use (if applicable)
        +      --workspace-id string   Databricks Workspace ID
        +
        +
         >>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
        -Error: --confirmation-code requires --use-device-code
        +Error: unknown flag: --user-code
         
        +Usage:
        +  databricks auth login [PROFILE] [flags]
        +
        +Flags:
        +      --client-id string       OAuth client ID to use for U2M authentication
        +      --configure-cluster      Prompts to configure cluster
        +      --configure-serverless   Prompts to configure serverless
        +  -h, --help                   help for login
        +      --resource stringArray   RFC 8707 resource indicator to scope the login to (repeatable). Requires --host.
        +      --scopes string          Comma-separated list of OAuth scopes to request (defaults to 'all-apis')
        +      --skip-workspace         Skip workspace selection for account-level access
        +      --timeout duration       Timeout for completing login challenge in the browser (default 1h0m0s)
        +
        +Global Flags:
        +      --account-id string     Databricks Account ID
        +      --debug                 enable debug logging
        +      --host string           Databricks Host
        +  -o, --output type           output type: text or json (default text)
        +  -p, --profile string        ~/.databrickscfg profile
        +  -t, --target string         bundle target to use (if applicable)
        +      --workspace-id string   Databricks Workspace ID
        +
        +
         === Account host
         
         >>> musterr [CLI] auth login --host https://accounts.cloud.databricks.test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
        -Warn: [hostmetadata] failed to fetch host metadata for https://accounts.cloud.databricks.test, will skip for 1m0s
        -Error: --use-device-code is only supported for workspace hosts
        +Error: unknown flag: --user-code
         
        +Usage:
        +  databricks auth login [PROFILE] [flags]
        +
        +Flags:
        +      --client-id string       OAuth client ID to use for U2M authentication
        +      --configure-cluster      Prompts to configure cluster
        +      --configure-serverless   Prompts to configure serverless
        +  -h, --help                   help for login
        +      --resource stringArray   RFC 8707 resource indicator to scope the login to (repeatable). Requires --host.
        +      --scopes string          Comma-separated list of OAuth scopes to request (defaults to 'all-apis')
        +      --skip-workspace         Skip workspace selection for account-level access
        +      --timeout duration       Timeout for completing login challenge in the browser (default 1h0m0s)
        +
        +Global Flags:
        +      --account-id string     Databricks Account ID
        +      --debug                 enable debug logging
        +      --host string           Databricks Host
        +  -o, --output type           output type: text or json (default text)
        +  -p, --profile string        ~/.databrickscfg profile
        +  -t, --target string         bundle target to use (if applicable)
        +      --workspace-id string   Databricks Workspace ID
        +
        +
         === Profile scoped to resources
         
         >>> musterr [CLI] auth login --profile resources --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
        -Error: --use-device-code cannot be used with profile resources because its login is scoped to resources. Log in without --use-device-code
        +Error: unknown flag: --user-code
         
        -=== No pending login
        +Usage:
... (120 more lines truncated, raise DATABRICKS_CLI_TEST_MAX_LOG to see more)

latest (v1.22.1):

acceptance_test.go:1341: Diff:
        --- cmd/auth/login/device-code/non-interactive/errors/output.txt
        +++ /tmp/TestAcceptcmdauthlogindevice-codenon-interactiveerrors1920297728/002/output.txt
        @@ -2,89 +2,329 @@
         === Device code login is disabled by default
         
         >>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code
        -Error: --use-device-code is experimental. Set DATABRICKS_CLI_DEVICE_CODE=true to enable it
        +Error: unknown flag: --use-device-code
         
        +Usage:
        +  databricks auth login [PROFILE] [flags]
        +
        +Flags:
        +      --client-id string       OAuth client ID to use for U2M authentication
        +      --configure-cluster      Prompts to configure cluster
        +      --configure-serverless   Prompts to configure serverless
        +  -h, --help                   help for login
        +      --resource stringArray   RFC 8707 resource indicator to scope the login to (repeatable). Requires --host.
        +      --scopes string          Comma-separated list of OAuth scopes to request (defaults to 'all-apis')
        +      --skip-workspace         Skip workspace selection for account-level access
        +      --timeout duration       Timeout for completing login challenge in the browser (default 1h0m0s)
        +
        +Global Flags:
        +      --account-id string     Databricks Account ID
        +      --debug                 enable debug logging
        +      --host string           Databricks Host
        +  -o, --output type           output type: text or json (default text)
        +  -p, --profile string        ~/.databrickscfg profile
        +  -t, --target string         bundle target to use (if applicable)
        +      --workspace-id string   Databricks Workspace ID
        +
        +
         >>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
        -Error: --use-device-code is experimental. Set DATABRICKS_CLI_DEVICE_CODE=true to enable it
        +Error: unknown flag: --use-device-code
         
        +Usage:
        +  databricks auth login [PROFILE] [flags]
        +
        +Flags:
        +      --client-id string       OAuth client ID to use for U2M authentication
        +      --configure-cluster      Prompts to configure cluster
        +      --configure-serverless   Prompts to configure serverless
        +  -h, --help                   help for login
        +      --resource stringArray   RFC 8707 resource indicator to scope the login to (repeatable). Requires --host.
        +      --scopes string          Comma-separated list of OAuth scopes to request (defaults to 'all-apis')
        +      --skip-workspace         Skip workspace selection for account-level access
        +      --timeout duration       Timeout for completing login challenge in the browser (default 1h0m0s)
        +
        +Global Flags:
        +      --account-id string     Databricks Account ID
        +      --debug                 enable debug logging
        +      --host string           Databricks Host
        +  -o, --output type           output type: text or json (default text)
        +  -p, --profile string        ~/.databrickscfg profile
        +  -t, --target string         bundle target to use (if applicable)
        +      --workspace-id string   Databricks Workspace ID
        +
        +
         === Flags the non-interactive login cannot honor
         
         >>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --configure-cluster
        -Error: --configure-cluster is not supported by the non-interactive device code login. Set cluster_id on the profile after the login
        +Error: unknown flag: --use-device-code
         
        +Usage:
        +  databricks auth login [PROFILE] [flags]
        +
        +Flags:
        +      --client-id string       OAuth client ID to use for U2M authentication
        +      --configure-cluster      Prompts to configure cluster
        +      --configure-serverless   Prompts to configure serverless
        +  -h, --help                   help for login
        +      --resource stringArray   RFC 8707 resource indicator to scope the login to (repeatable). Requires --host.
        +      --scopes string          Comma-separated list of OAuth scopes to request (defaults to 'all-apis')
        +      --skip-workspace         Skip workspace selection for account-level access
        +      --timeout duration       Timeout for completing login challenge in the browser (default 1h0m0s)
        +
        +Global Flags:
        +      --account-id string     Databricks Account ID
        +      --debug                 enable debug logging
        +      --host string           Databricks Host
        +  -o, --output type           output type: text or json (default text)
        +  -p, --profile string        ~/.databrickscfg profile
        +  -t, --target string         bundle target to use (if applicable)
        +      --workspace-id string   Databricks Workspace ID
        +
        +
         === Missing host
         
         >>> musterr [CLI] auth login --use-device-code
        -Error: --use-device-code requires a workspace host. Pass it as an argument or with --host
        +Error: unknown flag: --use-device-code
         
        +Usage:
        +  databricks auth login [PROFILE] [flags]
        +
        +Flags:
        +      --client-id string       OAuth client ID to use for U2M authentication
        +      --configure-cluster      Prompts to configure cluster
        +      --configure-serverless   Prompts to configure serverless
        +  -h, --help                   help for login
        +      --resource stringArray   RFC 8707 resource indicator to scope the login to (repeatable). Requires --host.
        +      --scopes string          Comma-separated list of OAuth scopes to request (defaults to 'all-apis')
        +      --skip-workspace         Skip workspace selection for account-level access
        +      --timeout duration       Timeout for completing login challenge in the browser (default 1h0m0s)
        +
        +Global Flags:
        +      --account-id string     Databricks Account ID
        +      --debug                 enable debug logging
        +      --host string           Databricks Host
        +  -o, --output type           output type: text or json (default text)
        +  -p, --profile string        ~/.databrickscfg profile
        +  -t, --target string         bundle target to use (if applicable)
        +      --workspace-id string   Databricks Workspace ID
        +
        +
         >>> musterr [CLI] auth login --profile test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
        -Error: --use-device-code requires a workspace host. Pass it as an argument or with --host
        +Error: unknown flag: --use-device-code
         
        +Usage:
        +  databricks auth login [PROFILE] [flags]
        +
        +Flags:
        +      --client-id string       OAuth client ID to use for U2M authentication
        +      --configure-cluster      Prompts to configure cluster
        +      --configure-serverless   Prompts to configure serverless
        +  -h, --help                   help for login
        +      --resource stringArray   RFC 8707 resource indicator to scope the login to (repeatable). Requires --host.
        +      --scopes string          Comma-separated list of OAuth scopes to request (defaults to 'all-apis')
        +      --skip-workspace         Skip workspace selection for account-level access
        +      --timeout duration       Timeout for completing login challenge in the browser (default 1h0m0s)
        +
        +Global Flags:
        +      --account-id string     Databricks Account ID
        +      --debug                 enable debug logging
        +      --host string           Databricks Host
        +  -o, --output type           output type: text or json (default text)
        +  -p, --profile string        ~/.databrickscfg profile
        +  -t, --target string         bundle target to use (if applicable)
        +      --workspace-id string   Databricks Workspace ID
        +
        +
         === Incomplete flags of the second step
         
         >>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --confirmation-code FTFA-QQKY
        -Error: --confirmation-code requires --user-code
        +Error: unknown flag: --use-device-code
         
        +Usage:
        +  databricks auth login [PROFILE] [flags]
        +
        +Flags:
        +      --client-id string       OAuth client ID to use for U2M authentication
        +      --configure-cluster      Prompts to configure cluster
        +      --configure-serverless   Prompts to configure serverless
        +  -h, --help                   help for login
        +      --resource stringArray   RFC 8707 resource indicator to scope the login to (repeatable). Requires --host.
        +      --scopes string          Comma-separated list of OAuth scopes to request (defaults to 'all-apis')
        +      --skip-workspace         Skip workspace selection for account-level access
        +      --timeout duration       Timeout for completing login challenge in the browser (default 1h0m0s)
        +
        +Global Flags:
        +      --account-id string     Databricks Account ID
        +      --debug                 enable debug logging
        +      --host string           Databricks Host
        +  -o, --output type           output type: text or json (default text)
        +  -p, --profile string        ~/.databrickscfg profile
        +  -t, --target string         bundle target to use (if applicable)
        +      --workspace-id string   Databricks Workspace ID
        +
        +
         >>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code WDJB-MJHT
        -Error: --user-code requires --confirmation-code
        +Error: unknown flag: --use-device-code
         
        +Usage:
        +  databricks auth login [PROFILE] [flags]
        +
        +Flags:
        +      --client-id string       OAuth client ID to use for U2M authentication
        +      --configure-cluster      Prompts to configure cluster
        +      --configure-serverless   Prompts to configure serverless
        +  -h, --help                   help for login
        +      --resource stringArray   RFC 8707 resource indicator to scope the login to (repeatable). Requires --host.
        +      --scopes string          Comma-separated list of OAuth scopes to request (defaults to 'all-apis')
        +      --skip-workspace         Skip workspace selection for account-level access
        +      --timeout duration       Timeout for completing login challenge in the browser (default 1h0m0s)
        +
        +Global Flags:
        +      --account-id string     Databricks Account ID
        +      --debug                 enable debug logging
        +      --host string           Databricks Host
        +  -o, --output type           output type: text or json (default text)
        +  -p, --profile string        ~/.databrickscfg profile
        +  -t, --target string         bundle target to use (if applicable)
        +      --workspace-id string   Databricks Workspace ID
        +
... (201 more lines truncated, raise DATABRICKS_CLI_TEST_MAX_LOG to see more)
TestAccept/cmd/auth/login/device-code/non-interactive/flags: branch ✅ | main (d27fd75) ❌ | latest (v1.22.1) ❌

main (d27fd75):

acceptance_test.go:1341: Diff:
        --- cmd/auth/login/device-code/non-interactive/flags/output.txt
        +++ /tmp/TestAcceptcmdauthlogindevice-codenon-interactiveflags667929973/002/output.txt
        @@ -8,29 +8,7 @@
         And enter the code:
         WDJB-MJHT
         
        -Once finished, complete the login by running the same command with
        ---user-code WDJB-MJHT and --confirmation-code set to the confirmation code
        -provided in your browser.
        +Once finished, enter the confirmation code provided in your browser.
        +Confirmation code: Error: reading confirmation code: EOF
         
        ->>> [CLI] auth login --profile scoped --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
        -Profile scoped was successfully saved
        -
        ->>> print_requests.py --oneline //oidc/v1/device/auth //oidc/v1/token
        -{"method": "POST", "path": "/oidc/v1/device/auth", "raw_body": "client_id=databricks-cli&scope=offline_access+sql"}
        -{"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=device-code-1&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
        -
        -=== Serverless compute is configured in the second step
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --profile serverless --use-device-code --configure-serverless
        -Using a browser on another device, visit:
        -[DATABRICKS_URL]/device/verification
        -
        -And enter the code:
        -WDJB-MJHT
        -
        -Once finished, complete the login by running the same command with
        ---user-code WDJB-MJHT and --confirmation-code set to the confirmation code
        -provided in your browser.
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --profile serverless --use-device-code --configure-serverless --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
        -Profile serverless was successfully saved
        +Exit code: 1
        
    acceptance_test.go:1312: Missing output file: out.databrickscfg

latest (v1.22.1):

acceptance_test.go:1341: Diff:
        --- cmd/auth/login/device-code/non-interactive/flags/output.txt
        +++ /tmp/TestAcceptcmdauthlogindevice-codenon-interactiveflags1809762593/002/output.txt
        @@ -2,35 +2,29 @@
         === Scopes and client ID from the profile
         
         >>> [CLI] auth login --profile scoped --use-device-code
        -Using a browser on another device, visit:
        -[DATABRICKS_URL]/device/verification
        +Error: unknown flag: --use-device-code
         
        -And enter the code:
        -WDJB-MJHT
        +Usage:
        +  databricks auth login [PROFILE] [flags]
         
        -Once finished, complete the login by running the same command with
        ---user-code WDJB-MJHT and --confirmation-code set to the confirmation code
        -provided in your browser.
        +Flags:
        +      --client-id string       OAuth client ID to use for U2M authentication
        +      --configure-cluster      Prompts to configure cluster
        +      --configure-serverless   Prompts to configure serverless
        +  -h, --help                   help for login
        +      --resource stringArray   RFC 8707 resource indicator to scope the login to (repeatable). Requires --host.
        +      --scopes string          Comma-separated list of OAuth scopes to request (defaults to 'all-apis')
        +      --skip-workspace         Skip workspace selection for account-level access
        +      --timeout duration       Timeout for completing login challenge in the browser (default 1h0m0s)
         
        ->>> [CLI] auth login --profile scoped --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
        -Profile scoped was successfully saved
        +Global Flags:
        +      --account-id string     Databricks Account ID
        +      --debug                 enable debug logging
        +      --host string           Databricks Host
        +  -o, --output type           output type: text or json (default text)
        +  -p, --profile string        ~/.databrickscfg profile
        +  -t, --target string         bundle target to use (if applicable)
        +      --workspace-id string   Databricks Workspace ID
         
        ->>> print_requests.py --oneline //oidc/v1/device/auth //oidc/v1/token
        -{"method": "POST", "path": "/oidc/v1/device/auth", "raw_body": "client_id=databricks-cli&scope=offline_access+sql"}
        -{"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=device-code-1&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
         
        -=== Serverless compute is configured in the second step
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --profile serverless --use-device-code --configure-serverless
        -Using a browser on another device, visit:
        -[DATABRICKS_URL]/device/verification
        -
        -And enter the code:
        -WDJB-MJHT
        -
        -Once finished, complete the login by running the same command with
        ---user-code WDJB-MJHT and --confirmation-code set to the confirmation code
        -provided in your browser.
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --profile serverless --use-device-code --configure-serverless --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
        -Profile serverless was successfully saved
        +Exit code: 1
        
    acceptance_test.go:1312: Missing output file: out.databrickscfg
TestAccept/cmd/auth/login/device-code/non-interactive/nominal: branch ✅ | main (d27fd75) ❌ | latest (v1.22.1) ❌

main (d27fd75):

acceptance_test.go:1341: Diff:
        --- cmd/auth/login/device-code/non-interactive/nominal/output.txt
        +++ /tmp/TestAcceptcmdauthlogindevice-codenon-interactivenominal854240656/002/output.txt
        @@ -8,106 +8,7 @@
         And enter the code:
         WDJB-MJHT
         
        -Once finished, complete the login by running the same command with
        ---user-code WDJB-MJHT and --confirmation-code set to the confirmation code
        -provided in your browser.
        +Once finished, enter the confirmation code provided in your browser.
        +Confirmation code: Error: reading confirmation code: EOF
         
        -=== The first step stores the device code and saves no profile
        -
        ->>> find.py home
        -home/.databricks/token-cache.json
        -
        ->>> cache_keys
        -[
        -  "[DATABRICKS_URL]#device-code"
        -]
        -
        -=== Confirm the login
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
        -
        ->>> [CLI] auth token --host [DATABRICKS_URL]
        -json.access_token = "oauth-token";
        -
        ->>> cache_keys
        -[
        -  "[DATABRICKS_URL]"
        -]
        -
        -=== Start the login with a profile
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code
        -Using a browser on another device, visit:
        -[DATABRICKS_URL]/device/verification
        -
        -And enter the code:
        -WDJB-MJHT
        -
        -Once finished, complete the login by running the same command with
        ---user-code WDJB-MJHT and --confirmation-code set to the confirmation code
        -provided in your browser.
        -
        -=== Confirm the login
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
        -Profile test was successfully saved
        -
        ->>> [CLI] auth token --profile test
        -json.access_token = "oauth-token";
        -
        ->>> [CLI] auth profiles
        -Name            Host                    Valid
        -test (Default)  [DATABRICKS_URL]  YES
        -
        -=== Start the login again with the host from the saved profile
        -
        ->>> [CLI] auth login --profile test --use-device-code
        -Using a browser on another device, visit:
        -[DATABRICKS_URL]/device/verification
        -
        -And enter the code:
        -WDJB-MJHT
        -
        -Once finished, complete the login by running the same command with
        ---user-code WDJB-MJHT and --confirmation-code set to the confirmation code
        -provided in your browser.
        -
        ->>> [CLI] auth token --profile test
        -json.access_token = "oauth-token";
        -
        ->>> [CLI] auth login --profile test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
        -Profile test was successfully saved
        -
        ->>> cache_keys
        -[
        -  "[DATABRICKS_URL]",
        -  "test"
        -]
        -
        ->>> print_requests.py --oneline //oidc/v1/device/auth //oidc/v1/token
        -{"method": "POST", "path": "/oidc/v1/device/auth", "raw_body": "client_id=databricks-cli&scope=offline_access+all-apis"}
        -{"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=device-code-1&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
        -{"method": "POST", "path": "/oidc/v1/device/auth", "raw_body": "client_id=databricks-cli&scope=offline_access+all-apis"}
        -{"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=device-code-2&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
        -{"method": "POST", "path": "/oidc/v1/device/auth", "raw_body": "client_id=databricks-cli&scope=offline_access+all-apis"}
        -{"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=device-code-3&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
        -
        -=== An AI agent gets notes on passing the login on to the user
        -
        ->>> AGENT=test-agent [CLI] auth login --host [DATABRICKS_URL] --profile agent --use-device-code
        -Using a browser on another device, visit:
        -[DATABRICKS_URL]/device/verification
        -
        -And enter the code:
        -WDJB-MJHT
        -
        -Note for AI agents (test-agent): give the URL and the code above to the user.
        -Do not open the URL or approve the login yourself: the user must approve it.
        -Ask the user for the confirmation code their browser shows.
        -
        -Once finished, complete the login by running the same command with
        ---user-code WDJB-MJHT and --confirmation-code set to the confirmation code
        -provided in your browser.
        -
        ->>> AGENT=test-agent [CLI] auth login --host [DATABRICKS_URL] --profile agent --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
        -Profile agent was successfully saved
        +Exit code: 1
        
    acceptance_test.go:1312: Missing output file: out.databrickscfg

latest (v1.22.1):

acceptance_test.go:1341: Diff:
        --- cmd/auth/login/device-code/non-interactive/nominal/output.txt
        +++ /tmp/TestAcceptcmdauthlogindevice-codenon-interactivenominal1345898512/002/output.txt
        @@ -2,112 +2,29 @@
         === Start the login without a profile
         
         >>> [CLI] auth login --host [DATABRICKS_URL] --use-device-code
        -Using a browser on another device, visit:
        -[DATABRICKS_URL]/device/verification
        +Error: unknown flag: --use-device-code
         
        -And enter the code:
        -WDJB-MJHT
        +Usage:
        +  databricks auth login [PROFILE] [flags]
         
        -Once finished, complete the login by running the same command with
        ---user-code WDJB-MJHT and --confirmation-code set to the confirmation code
        -provided in your browser.
        +Flags:
        +      --client-id string       OAuth client ID to use for U2M authentication
        +      --configure-cluster      Prompts to configure cluster
        +      --configure-serverless   Prompts to configure serverless
        +  -h, --help                   help for login
        +      --resource stringArray   RFC 8707 resource indicator to scope the login to (repeatable). Requires --host.
        +      --scopes string          Comma-separated list of OAuth scopes to request (defaults to 'all-apis')
        +      --skip-workspace         Skip workspace selection for account-level access
        +      --timeout duration       Timeout for completing login challenge in the browser (default 1h0m0s)
         
        -=== The first step stores the device code and saves no profile
        +Global Flags:
        +      --account-id string     Databricks Account ID
        +      --debug                 enable debug logging
        +      --host string           Databricks Host
        +  -o, --output type           output type: text or json (default text)
        +  -p, --profile string        ~/.databrickscfg profile
        +  -t, --target string         bundle target to use (if applicable)
        +      --workspace-id string   Databricks Workspace ID
         
        ->>> find.py home
        -home/.databricks/token-cache.json
         
        ->>> cache_keys
        -[
        -  "[DATABRICKS_URL]#device-code"
        -]
        -
        -=== Confirm the login
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
        -
        ->>> [CLI] auth token --host [DATABRICKS_URL]
        -json.access_token = "oauth-token";
        -
        ->>> cache_keys
        -[
        -  "[DATABRICKS_URL]"
        -]
        -
        -=== Start the login with a profile
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code
        -Using a browser on another device, visit:
        -[DATABRICKS_URL]/device/verification
        -
        -And enter the code:
        -WDJB-MJHT
        -
        -Once finished, complete the login by running the same command with
        ---user-code WDJB-MJHT and --confirmation-code set to the confirmation code
        -provided in your browser.
        -
        -=== Confirm the login
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
        -Profile test was successfully saved
        -
        ->>> [CLI] auth token --profile test
        -json.access_token = "oauth-token";
        -
        ->>> [CLI] auth profiles
        -Name            Host                    Valid
        -test (Default)  [DATABRICKS_URL]  YES
        -
        -=== Start the login again with the host from the saved profile
        -
        ->>> [CLI] auth login --profile test --use-device-code
        -Using a browser on another device, visit:
        -[DATABRICKS_URL]/device/verification
        -
        -And enter the code:
        -WDJB-MJHT
        -
        -Once finished, complete the login by running the same command with
        ---user-code WDJB-MJHT and --confirmation-code set to the confirmation code
        -provided in your browser.
        -
        ->>> [CLI] auth token --profile test
        -json.access_token = "oauth-token";
        -
        ->>> [CLI] auth login --profile test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
        -Profile test was successfully saved
        -
        ->>> cache_keys
        -[
        -  "[DATABRICKS_URL]",
        -  "test"
        -]
        -
        ->>> print_requests.py --oneline //oidc/v1/device/auth //oidc/v1/token
        -{"method": "POST", "path": "/oidc/v1/device/auth", "raw_body": "client_id=databricks-cli&scope=offline_access+all-apis"}
        -{"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=device-code-1&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
        -{"method": "POST", "path": "/oidc/v1/device/auth", "raw_body": "client_id=databricks-cli&scope=offline_access+all-apis"}
        -{"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=device-code-2&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
        -{"method": "POST", "path": "/oidc/v1/device/auth", "raw_body": "client_id=databricks-cli&scope=offline_access+all-apis"}
        -{"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=device-code-3&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
        -
        -=== An AI agent gets notes on passing the login on to the user
        -
        ->>> AGENT=test-agent [CLI] auth login --host [DATABRICKS_URL] --profile agent --use-device-code
        -Using a browser on another device, visit:
        -[DATABRICKS_URL]/device/verification
        -
        -And enter the code:
        -WDJB-MJHT
        -
        -Note for AI agents (test-agent): give the URL and the code above to the user.
        -Do not open the URL or approve the login yourself: the user must approve it.
        -Ask the user for the confirmation code their browser shows.
        -
        -Once finished, complete the login by running the same command with
        ---user-code WDJB-MJHT and --confirmation-code set to the confirmation code
        -provided in your browser.
        -
        ->>> AGENT=test-agent [CLI] auth login --host [DATABRICKS_URL] --profile agent --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
        -Profile agent was successfully saved
        +Exit code: 1
        
    acceptance_test.go:1312: Missing output file: out.databrickscfg

1 more failure details omitted, see the full report in the run.

@maksim-zuev-db
maksim-zuev-db removed this pull request from stack #7236 October 28, 2026 15:57
@maksim-zuev-db
maksim-zuev-db marked this pull request as ready for review October 28, 2026 16:02
@maksim-zuev-db
maksim-zuev-db requested review from a team as code owners October 28, 2026 16:02
@eng-dev-ecosystem-bot

Copy link
Copy Markdown
Collaborator

Integration test report

Commit: 6636d4c

Run: 40719481445

Env ✅​pass 🙈​skip Time
✅​ aws linux-2core-8gb 281 20 5:05
✅​ aws-windows-latest-4core-16gb 283 18 5:39
✅​ azure linux-2core-8gb 280 20 5:13
✅​ azure-windows-latest-4core-16gb 282 18 4:27
✅​ gcp linux-2core-8gb 281 20 5:12
✅​ gcp-windows-latest-4core-16gb 283 18 4:10
Top 6 slowest tests (at least 2 minutes):
duration env testname
5:35 aws-windows-latest-4core-16gb TestAccept
4:23 azure-windows-latest-4core-16gb TestAccept
3:41 gcp-windows-latest-4core-16gb TestAccept
3:38 azure linux-2core-8gb TestAccept
3:37 gcp linux-2core-8gb TestAccept
3:32 aws linux-2core-8gb TestAccept

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants