Add native support for Azure DevOps OIDC authentication #1027

Divyansh-db · 2025-08-14T09:03:45Z

Added native support for Azure DevOps OIDC authentication to allow authentication from Azure DevOps pipeline's environment.

Testing

Tested on an Azure DevOps project. Used the SDK to authenticate with a Databrick's workspace using Azure DevOps OIDC

Created a demo python files that uses the SDK to create a Workspace Client: This will test if the OIDC authentication is working

Created a pipeline to run the demo file. Set the necessary environment variables.
(System.AccessToken is slightly different, it needs to be exported through pipeline syntax: https://learn.microsoft.com/en-us/azure/devops/pipelines/build/variables?view=azure-devops&tabs=yaml#systemaccesstoken)

The pipeline runs successfully indicating that authentication succeeded.

Divyansh-db · 2025-09-18T08:50:43Z

databricks/sdk/credentials_provider.py

        @functools.wraps(func)
        def wrapper(cfg: "Config") -> Optional[CredentialsProvider]:
            for attr in require:
-                getattr(cfg, attr)


Seemed like unnecessary Double check

Are you sure? what does this function do?

This function checks if the attribute exists in the config or not. This check is redundant, as it is done in the next line as well

Divyansh-db · 2025-09-18T08:51:25Z

databricks/sdk/credentials_provider.py



 class DefaultCredentials:
-    """Select the first applicable credential provider from the chain"""


Strategy seems to be the correct word as we are trying different auth strategies until one suceeds

I remember discussing this a while ago and the decision was that provider was better.

I came after working in go SDK. It was named strategy there, therefore made the change here. But if this was already discussed then I will revert back to provider.

parthban-db · 2025-09-25T15:26:56Z

databricks/sdk/credentials_provider.py

        @functools.wraps(func)
        def wrapper(cfg: "Config") -> Optional[CredentialsProvider]:
            for attr in require:
-                getattr(cfg, attr)


Are you sure? what does this function do?

databricks/sdk/credentials_provider.py

databricks/sdk/oidc_token_supplier.py

hectorcast-db · 2025-09-29T08:32:41Z

databricks/sdk/credentials_provider.py

+    Supported in Azure DevOps pipelines with OIDC service connections.
+    """
+    try:
+        supplier = oidc_token_supplier.AzureDevOpsOIDCTokenSupplier()


Why is this needed? GitHubOIDCTokenSupplier does raise an exception, and therefore there is no try/catch. Is this different for a reason?

Same. For early exit.

hectorcast-db · 2025-09-29T08:33:58Z

databricks/sdk/credentials_provider.py

+        audience = cfg.oidc_endpoints.token_endpoint
+
+    # Try to get an idToken. If no supplier returns a token, we cannot use this authentication mode.
+    id_token = supplier.get_oidc_token(audience)


This function is almost the same as github_oidc. Can and should we reuse the code?

The old code should not be changed, right? The common part is within the GithubOIDC function. I can refactor the code to put the common parts outside it and use them in AzureDevOps. What is the better option?

On a quick look, I think that the only difference if the supplier being used.
We may be able to have

#TODO: better name def _internal_oidc(cfg: "Config", supplier: ) -> Optional[CredentialsProvider]: ... @oauth_credentials_strategy("azure-devops-oidc", ["host", "client_id"]) def azure_devops_oidc(cfg: "Config") -> Optional[CredentialsProvider]: return _internal_oidc(cfg, () -> oidc_token_supplier.AzureDevOpsOIDCTokenSupplier())

databricks/sdk/credentials_provider.py

hectorcast-db · 2025-09-29T08:38:23Z

databricks/sdk/oidc_token_supplier.py

            return None

        return response_json["value"]
+


Same: GitHubOIDC does not validate on create. Is there a reasons to change this?

This is done to ensure Early exit. This is similar to what is done in Go SDK. If the environment variables are not set then we are sure that we are not in Azure DevOps Environment so we should exit at the earliest and try other providers.

Could we add a TODO on the GitHub OIDC implementation to make it clear that it is the one with tech debt?

hectorcast-db

LGTM. Also get Parth approval.

renaudhartert-db · 2025-10-01T16:15:25Z

databricks/sdk/credentials_provider.py

+    Supported in GitHub Actions with OIDC service connections.
+    """
+    return _oidc_credentials_provider(
+        cfg=cfg, supplier_factory=lambda: oidc_token_supplier.GitHubOIDCTokenSupplier(), provider_name="GitHub OIDC"


This will tell the formatter to have one argument per line (like you do below).

Suggested change

cfg=cfg, supplier_factory=lambda: oidc_token_supplier.GitHubOIDCTokenSupplier(), provider_name="GitHub OIDC"

cfg=cfg, supplier_factory=lambda: oidc_token_supplier.GitHubOIDCTokenSupplier(), provider_name="GitHub OIDC",

renaudhartert-db · 2025-10-01T16:16:27Z

databricks/sdk/oidc_token_supplier.py

            return None

        return response_json["value"]
+


Could we add a TODO on the GitHub OIDC implementation to make it clear that it is the one with tech debt?

github-actions · 2025-10-01T16:42:02Z

If integration tests don't run automatically, an authorized user can run them manually by following the instructions below:

Trigger:
go/deco-tests-run/sdk-py

Inputs:

PR number: 1027
Commit SHA: ac5db4f4c619ff76e8fd2d6f699fda15cb70e483

Checks will be approved automatically on success.

Divyansh-db temporarily deployed to test-trigger-is August 14, 2025 09:03 — with GitHub Actions Inactive

Divyansh-db requested a review from parthban-db August 14, 2025 09:03

Divyansh-db temporarily deployed to test-trigger-is August 14, 2025 09:04 — with GitHub Actions Inactive

Divyansh-db temporarily deployed to test-trigger-is August 14, 2025 11:03 — with GitHub Actions Inactive

Divyansh-db temporarily deployed to test-trigger-is August 14, 2025 11:04 — with GitHub Actions Inactive

Divyansh-db commented Sep 18, 2025

View reviewed changes

Divyansh-db temporarily deployed to test-trigger-is September 18, 2025 09:30 — with GitHub Actions Inactive

Divyansh-db temporarily deployed to test-trigger-is September 18, 2025 09:31 — with GitHub Actions Inactive

Divyansh-db temporarily deployed to test-trigger-is September 18, 2025 12:17 — with GitHub Actions Inactive

Divyansh-db temporarily deployed to test-trigger-is September 18, 2025 12:18 — with GitHub Actions Inactive

Divyansh-db temporarily deployed to test-trigger-is September 18, 2025 12:23 — with GitHub Actions Inactive

Divyansh-db temporarily deployed to test-trigger-is September 18, 2025 12:27 — with GitHub Actions Inactive

Divyansh-db temporarily deployed to test-trigger-is September 18, 2025 12:28 — with GitHub Actions Inactive

Divyansh-db temporarily deployed to test-trigger-is September 18, 2025 12:44 — with GitHub Actions Inactive

Divyansh-db temporarily deployed to test-trigger-is September 18, 2025 12:45 — with GitHub Actions Inactive

Divyansh-db added 8 commits September 18, 2025 13:30

added Azure DevOps OIDC authentication

c1c95cb

improved naming convention and removed redundant code

8e4bb86

corrected azure devops OIDC token request

751c1a4

removed audience, used latest api version

d4175ae

formatting fixed

1bbc3c3

formatting fixed

fd24dc4

formatted using make fmt

553fd36

edded entry in changelog

5bbb16b

Divyansh-db force-pushed the divyansh-vijayvergia_data/Azure_DevOps_OIDC branch from 3e353da to 5bbb16b Compare September 18, 2025 13:39

Divyansh-db temporarily deployed to test-trigger-is September 18, 2025 13:39 — with GitHub Actions Inactive

Divyansh-db temporarily deployed to test-trigger-is September 18, 2025 13:40 — with GitHub Actions Inactive

Divyansh-db changed the title ~~added Azure DevOps OIDC authentication support~~ [DECO-25297] Add native support for Azure DevOps OIDC authentication Sep 18, 2025

Divyansh-db requested a review from hectorcast-db September 18, 2025 13:49

Divyansh-db temporarily deployed to test-trigger-is September 23, 2025 14:50 — with GitHub Actions Inactive

Divyansh-db temporarily deployed to test-trigger-is September 23, 2025 14:51 — with GitHub Actions Inactive

Divyansh-db added 2 commits September 24, 2025 13:37

added logging

14aa770

formatted

3b5ab96

Divyansh-db temporarily deployed to test-trigger-is September 24, 2025 13:38 — with GitHub Actions Inactive

Divyansh-db temporarily deployed to test-trigger-is September 24, 2025 13:39 — with GitHub Actions Inactive

parthban-db reviewed Sep 25, 2025

View reviewed changes

restructured code and tests

3393d78

Divyansh-db temporarily deployed to test-trigger-is September 25, 2025 18:09 — with GitHub Actions Inactive

Divyansh-db temporarily deployed to test-trigger-is September 25, 2025 18:10 — with GitHub Actions Inactive

Merge branch 'main' into divyansh-vijayvergia_data/Azure_DevOps_OIDC

4b4ca3e

Divyansh-db temporarily deployed to test-trigger-is September 25, 2025 18:11 — with GitHub Actions Inactive

Divyansh-db temporarily deployed to test-trigger-is September 25, 2025 18:12 — with GitHub Actions Inactive

hectorcast-db reviewed Sep 29, 2025

View reviewed changes

Divyansh-db requested a review from hectorcast-db September 29, 2025 09:01

refactored code for github and azure devops oidc

9f02727

Divyansh-db temporarily deployed to test-trigger-is September 29, 2025 13:33 — with GitHub Actions Inactive

hectorcast-db approved these changes Sep 30, 2025

View reviewed changes

Divyansh-db requested review from parthban-db and renaudhartert-db September 30, 2025 12:25

renaudhartert-db approved these changes Oct 1, 2025

View reviewed changes

addressed comments

ac5db4f

Divyansh-db temporarily deployed to test-trigger-is October 1, 2025 16:41 — with GitHub Actions Inactive

Divyansh-db added this pull request to the merge queue Oct 1, 2025

Merged via the queue into main with commit 88f1047 Oct 1, 2025
17 checks passed

Divyansh-db deleted the divyansh-vijayvergia_data/Azure_DevOps_OIDC branch October 1, 2025 17:35



		class DefaultCredentials:
		"""Select the first applicable credential provider from the chain"""

	cfg=cfg, supplier_factory=lambda: oidc_token_supplier.GitHubOIDCTokenSupplier(), provider_name="GitHub OIDC"
	cfg=cfg, supplier_factory=lambda: oidc_token_supplier.GitHubOIDCTokenSupplier(), provider_name="GitHub OIDC",

Add native support for Azure DevOps OIDC authentication #1027

Add native support for Azure DevOps OIDC authentication #1027

Conversation

Divyansh-db commented Aug 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Testing

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

hectorcast-db left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Oct 1, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Divyansh-db commented Aug 14, 2025 •

edited

Loading