Repository navigation
fix: send the token federation exchange through the connection agent - #611
Open
vuanhphung wants to merge 1 commit into
Open
vuanhphung wants to merge 1 commit into
vuanhphung wants to merge 1 commit into
Conversation
FederationProvider posted the `/oidc/v1/token` exchange with node-fetch and no agent, so `proxy`, `checkServerCertificate`, `customCaCert` and `clientCert`/`clientKey` did not apply to it. Behind a required proxy the exchange failed and the driver silently fell back to the original token. Pass the connection's agent for the exchange URL, as OAuth already does. Co-authored-by: Isaac <no-reply@databricks.com> Signed-off-by: Vu Anh Phung <vu.phung@databricks.com>
vuanhphung
had a problem deploying
to
azure-prod
November 13, 2026 18:41 — with 
GitHub Actions
Failure
GitHub Actions
Failure
vuanhphung
had a problem deploying
to
azure-prod
November 13, 2026 18:41 — with
GitHub Actions
Failure
GitHub Actions
Failure
vuanhphung
temporarily deployed
to
azure-prod
November 13, 2026 18:41 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
![peco-review-bot[bot]](https://avatars.githubusercontent.com/in/3801177?s=60&v=4){kind=small}
vuanhphung
temporarily deployed
to
azure-prod
November 13, 2026 20:42 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
vuanhphung
temporarily deployed
to
azure-prod
November 13, 2026 20:42 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
This branch was previously deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
With
enableTokenFederation(Thriftstatic-token,token-providerorexternal-tokenauth),FederationProviderposts the/oidc/v1/tokenexchange with node-fetch and no agent (FederationProvider.ts:169-181). The connection'sproxy,checkServerCertificate,customCaCertandclientCert/clientKeytherefore don't apply to it, unlike the SQL connection and the OAuth flows, which useconnectionProvider.getAgent(). Behind a required proxy the exchange fails, and with the defaultreturnOriginalTokenOnFailurethe driver silently sends the unexchanged token.Found by databricks-driver-test AUTH-011 (service-principal workload identity federation): on Thrift the proxy never sees the exchange. The test now runs on Node.js Thrift as an xfail tripwire.
Change
FederationProvidertakes an optionalgetAgent(url)and passes the agent to the exchange request.DBSQLClientwires it to the connection provider's agent for the exchange URL. WithoutgetAgentthe behavior is unchanged.Verification
getAgent, andDBSQLClientwiresgetAgentto the connection's agent.npm test(1753 passing),npm run lint,npm run prettier.main, the proxy records no OAuth calls for the Thrift exchange (run).XPASS. The proxy sees the RFC 8693 token exchange with the service-principalclient_id, the exchanged token is workspace-issued, andSELECT CURRENT_USER()returns one row (run). The rest of the Thrift suite passes; the only SEA failures there are TELEMETRY-001/004, warehouse-timing tests that also fail onmain.This pull request and its description were written by Isaac.