auth: decouple CLI from SDK's Experimental_IsUnifiedHost field#5047
Open
simonfaltum wants to merge 14 commits intomainfrom
Open
auth: decouple CLI from SDK's Experimental_IsUnifiedHost field#5047simonfaltum wants to merge 14 commits intomainfrom
simonfaltum wants to merge 14 commits intomainfrom
Conversation
Prepare for SDK PR databricks/databricks-sdk-go#1641 which removes the field, its env var, and the UnifiedHost case in HostType(). Thread the unified-host signal through CLI-owned types via a new HasUnifiedHostSignal helper and an explicit fallback parameter on IsSPOG. New profiles no longer persist experimental_is_unified_host; existing profiles still read the key for back-compat. The --experimental-is-unified-host flag and DATABRICKS_EXPERIMENTAL_IS_UNIFIED_HOST env var are deprecated no-ops for this release. Co-authored-by: Isaac
Addresses codex review findings on PR #5047. After dropping cfg.Experimental_IsUnifiedHost reads, CLICredentials.Configure and writeReauthSteps stopped honoring the INI fallback for profiles where .well-known is unreachable. This reads experimental_is_unified_host from the resolved profile's .databrickscfg section and threads it through AuthArguments.IsUnifiedHost so token cache keys and reauth suggestions continue to match. Also rewords the changelog and flag description from "no-op" to "deprecated but still honored as a routing fallback", which is what the code actually does. Co-authored-by: Isaac
…-experimental-unified-host # Conflicts: # acceptance/auth/credentials/unified-host/out.requests.txt
…-experimental-unified-host # Conflicts: # NEXT_CHANGELOG.md # libs/auth/credentials.go
…-experimental-unified-host
Unified hosts are now detected exclusively from /.well-known/databricks-config discovery. Drop the CLI flag, profile INI key reads, and the unifiedHostFallback threading from HasUnifiedHostSignal/IsSPOG/ResolveConfigType. Keep the Workspace.ExperimentalIsUnifiedHost field in bundle config as a no-op so existing databricks.yml files still validate. Co-authored-by: Isaac
Extract ExperimentalIsUnifiedHostKey constant in libs/databrickscfg so the legacy INI key isn't repeated as a string literal across login, token, and configure save paths. Add IsClassicAccountHost helper in libs/auth so the "https://accounts." / "https://accounts-dod." prefix check is defined once and reused from ToOAuthArgument, needsAccountIDPrompt, and the test. Co-authored-by: Isaac
…-experimental-unified-host # Conflicts: # NEXT_CHANGELOG.md
hectorcast-db
approved these changes
Apr 24, 2026
simonfaltum
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
simonfaltum
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
simonfaltum
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
simonfaltum
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
simonfaltum
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
simonfaltum
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Prep for SDK bump databricks/databricks-sdk-go#1641, which removes
Experimental_IsUnifiedHost, its env var, and theUnifiedHostcase inHostType(). After the bump the CLI wouldn't compile.Rather than stubbing the field and leaving the plumbing behind, this PR fully drops the flag from the CLI surface now that
.well-known/databricks-configdiscovery is the canonical way to detect unified hosts.Changes
Before: CLI wrote
Experimental_IsUnifiedHostinto every config, exposed--experimental-is-unified-host, readexperimental_is_unified_hostfrom.databrickscfgprofiles, and honored theDATABRICKS_EXPERIMENTAL_IS_UNIFIED_HOSTenv var.Now: unified-host routing comes entirely from
.well-known/databricks-config. Flag, env var, and profile key read are all gone. The only surviving mention is a deprecated no-op field onWorkspaceso existingdatabricks.ymlfiles validate.Removed:
--experimental-is-unified-hostflag (cmd/auth/auth.go)AuthArguments.IsUnifiedHostand theunifiedHostFallbackparameter threaded throughHasUnifiedHostSignal/IsSPOG/ResolveConfigTypelegacyUnifiedHostFromProfile()(libs/auth/credentials.go) and its caller inerror.goprofile.Profile.IsUnifiedHostand the INI key read inFileProfilerImpl.LoadProfilesprofileMetadata.isUnifiedHost(cmd/auth/profiles.go),applyUnifiedHostFlags(cmd/auth/token.go)acceptance/auth/credentials/unified-host/(tested the now-removed env var; discovery-based unified-host coverage remains inTestToOAuthArgument_SPOGHostRoutesToUnified,TestRunHostDiscovery_SPOGHost,TestProfileLoadSPOGConfigType,TestLogoutSPOGProfile, all using mock.well-knownservers)Kept:
Workspace.ExperimentalIsUnifiedHostinbundle/config/workspace.goas a deprecated no-op field so existingdatabricks.ymlstill validates. Annotation updated.experimental_is_unified_hostfrom profiles on OAuth login andconfiguresave, so legacy keys get cleaned up on re-login.Shared helpers extracted while touching the code:
databrickscfg.ExperimentalIsUnifiedHostKeyconstant for the cleanup-only INI key (was 4 string literals)auth.IsClassicAccountHosthelper replacing 3 copies of theaccounts./accounts-dod.prefix checkBack-compat:
experimental_is_unified_host = true, reachable.well-known/databricks-configexperimental_is_unified_host = true, unreachable.well-known--experimental-is-unified-hostflagDATABRICKS_EXPERIMENTAL_IS_UNIFIED_HOSTenv varauth loginagainst a unified hostdatabricks.ymlwithexperimental_is_unified_host: trueTest plan
make checkscleanmake lint0 issuesgo test ./libs/auth/... ./cmd/auth/... ./bundle/config/... ./libs/databrickscfg/... ./cmd/configure/...go test ./acceptance -run 'TestAccept/(cmd/auth|auth|cmd/configure)'make schemaandmake docsregenerated; bundle tests green