The databricks-sql-connector raises a generic RuntimeError with the message
"No valid authentication settings!" when no usable credentials are present
(e.g. a cleared/expired OAuth2 token). Add it to oauth2_auth_failure_signals
so needs_oauth2 bootstraps the OAuth2 dance for that case as well.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Addresses review feedback on the Databricks OAuth2 flow:
- `oauth2_exception` was set to `OAuth2RedirectError` (Superset's own redirect
signal, also the base default), so `needs_oauth2()` never matched a real
Databricks token failure and the dance never auto-started. The driver has no
dedicated auth exception, so detect auth failures from the error message
instead (mirrors `GSheetsEngineSpec.needs_oauth2`).
- The per-cloud endpoint templates pointed Azure at Entra ID directly
(`login.microsoftonline.com`) and required `account_id`/`tenant_id`
substitution. Databricks fronts the U2M flow on every workspace at
`https://<host>/oidc/v1/{authorize,token}` across AWS/Azure/GCP, so the
authorization endpoint now derives from the workspace host with no account
identifier. The token endpoint still requires explicit config (no DB context
at exchange time); the error and docs now point at the workspace-host URL.
Shared OAuth logic is consolidated onto `DatabricksDynamicBaseEngineSpec`,
removing the duplicated overrides in both engine specs.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The per-cloud OAuth2 endpoint templates carry a `{}` placeholder for the
Databricks account id (or Azure tenant id) that was never substituted, so
auto-detected authorize/token URLs were emitted as `.../accounts/{}/v1/...`.
The authorization-URI methods also unconditionally overwrote a fully-resolved
`authorization_request_uri` supplied via DATABASE_OAUTH2_CLIENTS.
- Add `_resolve_oauth2_endpoint`: substitutes `account_id`/`tenant_id` from the
database extra into the template, or raises OAuth2Error when absent instead of
issuing a request to an unresolved endpoint.
- Preserve a configured `authorization_request_uri`; only auto-detect/resolve
when none is set.
- `get_oauth2_token` has no database context to auto-detect, so fail fast on a
missing `token_request_uri` rather than POST to `.../{}/v1/token`.
- Cover auto-detect/resolve, preserve-configured, and fail-fast paths for both
the native and Python-connector specs; document `account_id`/`tenant_id`.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
