Return clear error when auth token is used with M2M profile#4594
Merged
simonfaltum merged 3 commits intomainfrom Feb 26, 2026
Merged
Return clear error when auth token is used with M2M profile#4594simonfaltum merged 3 commits intomainfrom
auth token is used with M2M profile#4594simonfaltum merged 3 commits intomainfrom
Conversation
Previously, `databricks auth token --profile <m2m-profile>` would silently return the wrong token (a cached U2M token for the same host) or trigger an interactive browser login. This was confusing because the command gave no indication that M2M profiles are unsupported. Now the command detects when the resolved profile has a client_id configured and returns an explicit error explaining that `auth token` only supports U2M authentication. Fixes #1939
simonfaltum
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
Collaborator
|
Commit: 6b78d45
15 interesting tests: 7 KNOWN, 7 SKIP, 1 RECOVERED
Top 20 slowest tests (at least 2 minutes):
|
The M2M guard checked existingProfile, but that variable was not updated when a profile was resolved later via host matching. This meant `--host <url>` that uniquely matched an M2M profile would bypass the check and fall through to the U2M token lookup. Now existingProfile is updated in both branches of the host-matching block (single match and interactive selection), and a new test covers the host-resolved path.
simonfaltum
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
Replace ClientID string with HasClientCredentials bool that requires both client_id and client_secret in the profile. Fix gofmt alignment.
simonfaltum
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
simonfaltum
requested review from
andrewnester,
anton-107,
denik,
pietern and
shreyas-goenka
as code owners
shreyas-goenka
approved these changes
Feb 26, 2026
deco-sdk-tagging bot
added a commit
that referenced
this pull request
Feb 26, 2026
## Release v0.290.1 ### CLI * Return clear error when `auth token` is used with M2M profile ([#4594](#4594)) * Pin `apps init` to Appkit `template-v0.11.0` by default ([#4585](#4585)) * Pin Agent Skills installer to v0.1.1 ([#4609](#4609)) ### Bundles * direct: Use async Update API for Apps update ([#4607](#4607)) * Proactively create the resource path for dashboards ([#4608](#4608))
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes #1939
When
databricks auth token --profile <m2m-profile>is used with a profile that hasclient_id/client_secretconfigured (M2M / service principal auth), the command currently either:This PR adds early detection of M2M profiles and returns a clear error:
Changes
ClientIDfield toprofile.Profilestruct (populated from.databrickscfg)loadTokenthat detects M2M profiles before attempting U2M token lookupexistingProfileis reloaded so the M2M guard also covers--hostinvocations that resolve to a single M2M profile--profileflag, positional argument, and host-based matchingTest plan
M2M profile returns clear error— explicit--profiletargeting M2M profileM2M profile detected via positional arg— positional arg resolves to M2M profileM2M profile detected via host resolution—--hostuniquely matches an M2M profileTestToken_loadTokencases pass (no regressions)make checkspassesmake lintfullpasses