feat(cli): add `datahub init --sso` for browser-based SSO login by shirshanka · Pull Request #16715 · datahub-project/datahub

shirshanka · 2026-03-22T07:52:03Z

Summary

Adds --sso flag to datahub init that opens a Chromium browser via Playwright, lets the user complete SSO (OIDC/SAML), then automatically captures the session and generates a personal access token — no manual copy-paste needed.
Playwright is an optional dependency behind the sso extra (pip install 'acryl-datahub[sso]'). If not installed, the command prints clear step-by-step instructions (supports pip, uv, etc.).
No server-side changes required.

Usage

# One-time setup
pip install 'acryl-datahub[sso]'
playwright install chromium

# SSO login
datahub init --sso --host https://your-instance.example.com/gms

Files changed

File	What
`sso_cli.py` (new)	Playwright browser flow: open → wait for actor cookie → extract cookies → generate token via GraphQL
`entrypoints.py`	`--sso` click option, SSO branch in `init()`, mutual exclusivity validation
`setup.py`	`sso` extra: `playwright>=1.40.0`
`INIT_AGENT_CONTEXT.md`	Document `--sso` flag and prerequisites
`test_init_cli.py`	5 tests: incompatible flags, happy path, duration, URL derivation
`test_sso_cli.py` (new)	4 tests: cookie extraction, timeout, missing cookie, GraphQL error

Test plan

./gradlew :metadata-ingestion:lintFix passes
pytest tests/unit/cli/test_init_cli.py tests/unit/cli/test_sso_cli.py — 39 tests pass
Manual: clean venv without playwright → clear error message with install instructions
Manual: datahub init --sso --host https://acryl.acryl.io/gms → browser opens, SSO completes, token saved, datahub graphql query succeeds

🤖 Generated with Claude Code

github-actions · 2026-03-22T07:52:12Z

Linear: ING-2022

codecov · 2026-03-22T07:53:55Z

Codecov Report

❌ Patch coverage is 93.33333% with 6 lines in your changes missing coverage. Please review.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
metadata-ingestion/src/datahub/cli/sso_cli.py	91.54%	6 Missing ⚠️

📢 Thoughts on this report? Let us know!

datahub-connector-tests · 2026-03-22T08:34:08Z

Connector Tests Results

All connector tests passed for commit 5d87b3a

View full test logs →

To skip connector tests, add the skip-connector-tests label (org members only).

Autogenerated by the connector-tests CI pipeline.

Users authenticating via SSO (OIDC/SAML) can now configure the CLI without manual token copy-paste. The `--sso` flag opens a Chromium browser via Playwright, lets the user complete SSO, then automatically extracts the session and generates a personal access token. Flow: browser opens → user completes SSO → CLI captures actor cookie → generates token via GraphQL → writes ~/.datahubenv. No server-side changes required. Playwright is an optional dependency behind the `sso` extra (`pip install 'acryl-datahub[sso]'`). Clear install instructions are shown if it's missing. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

CI fixes: - Add upper bound to playwright dependency (<2.0.0) to satisfy check-python-deps pinning rules - Run mdPrettierWrite to fix markdown formatting in INIT_AGENT_CONTEXT.md Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Adds `--support` flag (used with `--sso`) that navigates to `/support/authenticate` instead of `/authenticate`, enabling the support team to log into customer instances for debugging. Usage: datahub init --sso --support --host https://customer.acryl.io/gms Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

After SSO login, query existing access tokens for the user and print a count of CLI tokens with a link to manage them in the UI. This gives users visibility into token accumulation without auto-revoking tokens that may be in use elsewhere. Also removes the broken _revoke_old_cli_tokens call that would crash at runtime and the unused List import. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

metadata-ingestion/src/datahub/cli/sso_cli.py

Co-authored-by: Tamas Nemeth <treff7es@gmail.com>

alwaysmeticulous · 2026-03-24T17:31:26Z

🔴 Meticulous spotted visual differences in 18 of 1853 screens tested: view and approve differences detected.

Meticulous evaluated ~8 hours of user flows against your PR.

_{Last updated for commit 5d87b3a. This comment will update as new commits are pushed.}

- Move createAccessToken error handling from _warn_about_existing_cli_tokens to browser_sso_login where it belongs - Fix tab/space mixing in browser try/finally block - Remove redundant browser.close() in inner except (finally handles it) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

codecov · 2026-03-25T04:39:36Z

Bundle Report

Changes will decrease total bundle size by 284.35kB (-1.24%) ⬇️. This is within the configured threshold ✅

Detailed changes

Bundle name	Size	Change
datahub-react-web-esm	22.68MB	-284.35kB (-1.24%) ⬇️

Affected Assets, Files, and Routes:

view changes for bundle: datahub-react-web-esm

Assets Changed:

Asset Name	Size Change	Total Size	Change (%)
`assets/index-*.js`	-365.44kB	12.45MB	-2.85%
*`assets/flinklogo-.svg`** (New)	81.09kB	81.09kB	100.0% 🚀

github-actions bot added the ingestion PR or Issue related to the ingestion of metadata label Mar 22, 2026

github-actions bot deployed to datahub-wheels (Preview) March 22, 2026 07:53 View deployment

github-actions bot deployed to datahub-wheels (Preview) March 22, 2026 08:03 View deployment

maggiehays added the needs-review Label for PRs that need review from a maintainer. label Mar 22, 2026

vercel bot deployed to Preview March 22, 2026 08:17 View deployment

github-actions bot deployed to datahub-wheels (Preview) March 22, 2026 16:30 View deployment

github-actions bot deployed to datahub-wheels (Preview) March 22, 2026 16:33 View deployment

vercel bot deployed to Preview March 22, 2026 16:47 View deployment

github-actions bot deployed to datahub-wheels (Preview) March 22, 2026 20:46 View deployment

vercel bot deployed to Preview March 22, 2026 21:00 View deployment

shirshanka and others added 5 commits March 23, 2026 15:09

fix(cli): rename Acryl Cloud to DataHub Cloud in test comments

2522c05

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

treff7es force-pushed the worktree-init-sso-browser branch from 1a64d2c to e3481fb Compare March 23, 2026 14:09

github-actions bot deployed to datahub-wheels (Preview) March 23, 2026 14:11 View deployment

vercel bot deployed to Preview March 23, 2026 14:26 View deployment

treff7es approved these changes Mar 24, 2026

View reviewed changes

metadata-ingestion/src/datahub/cli/sso_cli.py Show resolved Hide resolved

metadata-ingestion/src/datahub/cli/sso_cli.py Outdated Show resolved Hide resolved

metadata-ingestion/src/datahub/cli/sso_cli.py Outdated Show resolved Hide resolved

shirshanka and others added 3 commits March 24, 2026 10:17

Update metadata-ingestion/src/datahub/cli/sso_cli.py

562cafc

Co-authored-by: Tamas Nemeth <treff7es@gmail.com>

Update metadata-ingestion/src/datahub/cli/sso_cli.py

c63dc37

Co-authored-by: Tamas Nemeth <treff7es@gmail.com>

Update metadata-ingestion/src/datahub/cli/sso_cli.py

a232033

Co-authored-by: Tamas Nemeth <treff7es@gmail.com>

github-actions bot deployed to datahub-wheels (Preview) March 24, 2026 17:19 View deployment

github-actions bot deployed to datahub-project-web-react (Preview) March 24, 2026 17:22 View deployment

vercel bot deployed to Preview March 24, 2026 17:34 View deployment

github-actions bot deployed to datahub-wheels (Preview) March 25, 2026 04:18 View deployment

github-actions bot deployed to datahub-project-web-react (Preview) March 25, 2026 04:21 View deployment

vercel bot deployed to Preview March 25, 2026 04:32 View deployment

shirshanka merged commit 611c3e8 into master Mar 25, 2026
86 of 89 checks passed

shirshanka deleted the worktree-init-sso-browser branch March 25, 2026 05:09

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(cli): add `datahub init --sso` for browser-based SSO login#16715

feat(cli): add `datahub init --sso` for browser-based SSO login#16715
shirshanka merged 9 commits intomasterfrom
worktree-init-sso-browser

shirshanka commented Mar 22, 2026

Uh oh!

github-actions bot commented Mar 22, 2026

Uh oh!

codecov bot commented Mar 22, 2026 •

edited

Loading

Uh oh!

datahub-connector-tests bot commented Mar 22, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

alwaysmeticulous bot commented Mar 24, 2026 •

edited

Loading

Uh oh!

codecov bot commented Mar 25, 2026

Assets Changed:

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

shirshanka commented Mar 22, 2026

Summary

Usage

Files changed

Test plan

Uh oh!

github-actions bot commented Mar 22, 2026

Uh oh!

codecov bot commented Mar 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

datahub-connector-tests bot commented Mar 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Connector Tests Results

Uh oh!

Uh oh!

Uh oh!

Uh oh!

alwaysmeticulous bot commented Mar 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov bot commented Mar 25, 2026

Bundle Report

Affected Assets, Files, and Routes:

Assets Changed:

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

codecov bot commented Mar 22, 2026 •

edited

Loading

datahub-connector-tests bot commented Mar 22, 2026 •

edited

Loading

alwaysmeticulous bot commented Mar 24, 2026 •

edited

Loading