[ISSUE] Issue with `databricks_connection` SQL SERVER M2M OAuth resource

[tim-mills-cb]

Configuration

  name            = "sql_connection"
  connection_type = "SQLSERVER"
  options = {
    host                   = "sql-host"
    port                   = 1433
    applicationIntent      = "ReadOnly"
    client_id              = "client_id"
    client_secret          = "client_secret"
    authorization_endpoint = "https://login.microsoftonline.com/${data.azurerm_client_config.current.tenant_id}/oauth2/token"
  }
  read_only = true
}

Expected Behavior

Connection should be created using the newly support OAuth M2M instead of it trying to create using U2M.

Actual Behavior

Error: cannot create connection: CONNECTION/CONNECTION_SQLSERVER_OAUTH_U2M must include the following option(s): oauth_redirect_uri,pkce_verifier,oauth_scope,authorization_code.

Steps to Reproduce

1. terraform apply-->

Terraform and provider versions

Terraform v1.13.3
on windows_amd64

• provider registry.terraform.io/azure/azapi v2.7.0
• provider registry.terraform.io/databricks/databricks v1.97.0
• provider registry.terraform.io/hashicorp/azuread v2.33.0
• provider registry.terraform.io/hashicorp/azurerm v3.117.1
• provider registry.terraform.io/hashicorp/external v1.2.0
• provider registry.terraform.io/hashicorp/local v1.4.0
• provider registry.terraform.io/hashicorp/null v2.1.2
• provider registry.terraform.io/hashicorp/random v3.7.2
• provider registry.terraform.io/hashicorp/time v0.12.1

Is it a regression?

Not worked since the release of SQL Server M2M

Debug Output

Important Factoids

Would you like to implement a fix?

[alexott]

It's not a Terraform piece - the error comes from the backend, TF doesn't do any validation. Please open support ticket

[NathanNZ]

I'd expect that "authorization_endpoint " shouldn't end in /token - perhaps you meant "token_endpoint"?

U2M uses "authorization" endpoint to pop the interactive window (https://auth0.com/docs/get-started/authentication-and-authorization-flow/authorization-code-flow), and "M2M' takes a token endpoint where it sends the client id and secret to negotiate the token in response.

I'd assume you're getting this error because the backend logic is probably assuming it's U2M unless a token_endpoint is provided.

In a perfect world Databricks would also support service connectors for those running in Azure Databricks, holding out the hope one day 🤞 (https://docs.azure.cn/en-us/databricks/connect/unity-catalog/cloud-services/service-credentials) - so much easier than juggling client secrets 😁