Add custom scopes support in OAuth authentication methods #1374

Tejas-Kochar · 2025-12-15T05:33:04Z

Summary

Adds new Scopes and DisableOAuthRefreshToken fields.
Adds support for parsing lists in config files.

Notes

Environment variable support is not provided for scopes because we do not think users would actually want this. It can be easily added as a follow up if there are requests for it.

Testing

Parsing logic tested by loading profiles from a test .databrickscfg file.

Subsequent PRs add support for custom scopes in OAuth authentication methods:

NO_CHANGELOG=true

Tejas-Kochar · 2025-12-15T06:56:45Z

config/experimental/auth/oidc/tokensource_test.go

 				ClientID:              tc.clientID,
 				AccountID:             tc.accountID,
 				Host:                  tc.host,
+				Scopes:                []string{"all-apis"},


This change is being made to an existing test that relied on "all-apis" being hard coded further downstream. The test exercises a part of the WIF flow that now expects the default scope of "all-apis" to already have been set if scopes are left empty.

…eparately

renaudhartert-db · 2026-01-03T18:18:24Z

config/config_file_test.go

+	}
+}
+
+func TestConfigFile_Scopes(t *testing.T) {


Should we remove this test? It looks redundant with the two tests we have added. If you decide to keep it, please update:

withMockEnv(t, map[string]string{}) t.Setenv("HOME", "testdata/scopes")

to

withMockEnv(t, map[string]string{"HOME": "testdata/scopes"})

I would prefer keeping it as it acts as an integration test and ensures backwards compatibility (the first case checks that "all-apis" is used if no scopes are provided in the config file).

Made the change.

github-actions · 2026-01-04T12:16:18Z

If integration tests don't run automatically, an authorized user can run them manually by following the instructions below:

Trigger:
go/deco-tests-run/sdk-go

Inputs:

PR number: 1374
Commit SHA: 8a4c1b5f511f9ac73c3d6460fa0ed214512a0dbe

Checks will be approved automatically on success.

## Summary One-line change passing configured scopes instead of hard-coded value "all-apis". You might also see changes from parent branch #1374 ## Testing Test the (mocked) authentication of requests configured for M2M with various different scopes (nil, empty, single, multiple unsorted). Custom scopes tested for both Account and Workspace level requests. --- NO_CHANGELOG=true

Tejas-Kochar self-assigned this Dec 15, 2025

Tejas-Kochar temporarily deployed to test-trigger-is December 15, 2025 05:33 — with GitHub Actions Inactive

Tejas-Kochar temporarily deployed to test-trigger-is December 15, 2025 05:34 — with GitHub Actions Inactive

Tejas-Kochar temporarily deployed to test-trigger-is December 15, 2025 06:09 — with GitHub Actions Inactive

Tejas-Kochar temporarily deployed to test-trigger-is December 15, 2025 06:10 — with GitHub Actions Inactive

Tejas-Kochar commented Dec 15, 2025

View reviewed changes

Tejas-Kochar temporarily deployed to test-trigger-is December 15, 2025 07:12 — with GitHub Actions Inactive

Tejas-Kochar temporarily deployed to test-trigger-is December 15, 2025 07:13 — with GitHub Actions Inactive

Tejas-Kochar temporarily deployed to test-trigger-is December 15, 2025 07:24 — with GitHub Actions Inactive

Tejas-Kochar temporarily deployed to test-trigger-is December 15, 2025 07:25 — with GitHub Actions Inactive

Tejas-Kochar temporarily deployed to test-trigger-is December 15, 2025 12:07 — with GitHub Actions Inactive

Tejas-Kochar requested a review from hectorcast-db December 15, 2025 12:08

Tejas-Kochar force-pushed the custom-scopes branch from 3ce3b15 to dab64d8 Compare December 15, 2025 14:01

Tejas-Kochar temporarily deployed to test-trigger-is December 15, 2025 14:02 — with GitHub Actions Inactive

Tejas-Kochar temporarily deployed to test-trigger-is December 15, 2025 14:03 — with GitHub Actions Inactive

Tejas-Kochar temporarily deployed to test-trigger-is December 16, 2025 08:32 — with GitHub Actions Inactive

Tejas-Kochar temporarily deployed to test-trigger-is December 16, 2025 08:33 — with GitHub Actions Inactive

Tejas-Kochar force-pushed the custom-scopes branch from 6bcf771 to 737f291 Compare December 16, 2025 12:13

Tejas-Kochar temporarily deployed to test-trigger-is December 16, 2025 12:13 — with GitHub Actions Inactive

Tejas-Kochar temporarily deployed to test-trigger-is December 16, 2025 12:14 — with GitHub Actions Inactive

Tejas-Kochar force-pushed the custom-scopes branch from 737f291 to 466fc83 Compare December 16, 2025 12:16

Tejas-Kochar temporarily deployed to test-trigger-is December 16, 2025 12:16 — with GitHub Actions Inactive

Tejas-Kochar changed the title ~~Add custom scopes support in OAuth authentication methods~~ Add custom scopes support in WIF and M2M OAuth authentication methods Dec 16, 2025

Tejas-Kochar changed the title ~~Add custom scopes support in WIF and M2M OAuth authentication methods~~ Add custom scopes support in OAuth authentication methods Dec 16, 2025

Tejas-Kochar force-pushed the custom-scopes branch from 466fc83 to dab64d8 Compare December 16, 2025 13:07

Tejas-Kochar temporarily deployed to test-trigger-is December 16, 2025 13:07 — with GitHub Actions Inactive

Tejas-Kochar temporarily deployed to test-trigger-is December 16, 2025 13:09 — with GitHub Actions Inactive

Tejas-Kochar removed the request for review from hectorcast-db December 18, 2025 07:08

Tejas-Kochar temporarily deployed to test-trigger-is January 3, 2026 07:56 — with GitHub Actions Inactive

Tejas-Kochar temporarily deployed to test-trigger-is January 3, 2026 07:57 — with GitHub Actions Inactive

restore test

39b0010

Tejas-Kochar temporarily deployed to test-trigger-is January 3, 2026 08:19 — with GitHub Actions Inactive

Tejas-Kochar temporarily deployed to test-trigger-is January 3, 2026 08:20 — with GitHub Actions Inactive

Tejas-Kochar requested a review from renaudhartert-db January 3, 2026 08:23

Use slices package

73b90af

Tejas-Kochar temporarily deployed to test-trigger-is January 3, 2026 12:25 — with GitHub Actions Inactive

Tejas-Kochar temporarily deployed to test-trigger-is January 3, 2026 12:26 — with GitHub Actions Inactive

Tejas-Kochar added 2 commits January 3, 2026 14:06

Make environment mockable and improve test (use want/got)

dab2f87

Test scopes sorting and deduplication, and config file list parsing s…

c6eea37

…eparately

Tejas-Kochar temporarily deployed to test-trigger-is January 3, 2026 14:08 — with GitHub Actions Inactive

Tejas-Kochar temporarily deployed to test-trigger-is January 3, 2026 14:09 — with GitHub Actions Inactive

renaudhartert-db approved these changes Jan 3, 2026

View reviewed changes

remove unnecessary line

cfa26f9

Tejas-Kochar temporarily deployed to test-trigger-is January 4, 2026 11:32 — with GitHub Actions Inactive

Tejas-Kochar temporarily deployed to test-trigger-is January 4, 2026 11:33 — with GitHub Actions Inactive

Make os.UserHomeDir mockable

8ad6dd7

Tejas-Kochar temporarily deployed to test-trigger-is January 4, 2026 12:13 — with GitHub Actions Inactive

Tejas-Kochar temporarily deployed to test-trigger-is January 4, 2026 12:14 — with GitHub Actions Inactive

Merge branch 'main' into custom-scopes

8a4c1b5

Tejas-Kochar temporarily deployed to test-trigger-is January 4, 2026 12:16 — with GitHub Actions Inactive

Tejas-Kochar enabled auto-merge January 4, 2026 12:16

Tejas-Kochar added this pull request to the merge queue Jan 4, 2026

Merged via the queue into main with commit 2afaab5 Jan 4, 2026
15 checks passed

Tejas-Kochar deleted the custom-scopes branch January 4, 2026 12:29

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add custom scopes support in OAuth authentication methods #1374

Add custom scopes support in OAuth authentication methods #1374

Uh oh!

Tejas-Kochar commented Dec 15, 2025 •

edited

Loading

Uh oh!

Tejas-Kochar Dec 15, 2025

Uh oh!

renaudhartert-db Jan 3, 2026

Uh oh!

Tejas-Kochar Jan 4, 2026

Uh oh!

github-actions bot commented Jan 4, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Add custom scopes support in OAuth authentication methods #1374

Add custom scopes support in OAuth authentication methods #1374

Uh oh!

Conversation

Tejas-Kochar commented Dec 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Notes

Testing

Uh oh!

Tejas-Kochar Dec 15, 2025

Choose a reason for hiding this comment

Uh oh!

renaudhartert-db Jan 3, 2026

Choose a reason for hiding this comment

Uh oh!

Tejas-Kochar Jan 4, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Jan 4, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Tejas-Kochar commented Dec 15, 2025 •

edited

Loading