You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@superset.apache.org by ru...@apache.org on 2026/06/25 09:17:38 UTC
(superset) 05/05: fix(databricks): preserve resolved OAuth2 token request URI
This is an automated email from the ASF dual-hosted git repository.
rusackas pushed a commit to branch adopt/databricks-oauth
in repository https://gitbox.apache.org/repos/asf/superset.git
commit 47b7e010daed3ccfa94349bf118d2dcc73521193
Author: Evan <ev...@preset.io>
AuthorDate: Thu Jun 25 02:16:54 2026 -0700
fix(databricks): preserve resolved OAuth2 token request URI
get_oauth2_token clobbered the config's already-resolved token_request_uri
with the AWS template that still contained an unsubstituted account-id
placeholder, so the token exchange POSTed to .../accounts/{}/v1/token. Only
fall back to the AWS endpoint when no token_request_uri is configured.
Co-authored-by: fabian_zse <fa...@zalando.de>
Co-Authored-By: Claude Opus 4.8 <no...@anthropic.com>
---
superset/db_engine_specs/databricks.py | 44 ++++++++++++++++++++--------------
1 file changed, 26 insertions(+), 18 deletions(-)
diff --git a/superset/db_engine_specs/databricks.py b/superset/db_engine_specs/databricks.py
index 05aeda1c3c6..c65dd36ab48 100644
--- a/superset/db_engine_specs/databricks.py
+++ b/superset/db_engine_specs/databricks.py
@@ -596,18 +596,22 @@ class DatabricksNativeEngineSpec(DatabricksDynamicBaseEngineSpec):
"""
Exchange authorization code for refresh/access tokens with dynamic endpoint.
- Note: For token exchange, we need the database context from the state.
- This is a limitation of the current OAuth2 flow design.
+ The token request URI is resolved when the OAuth2 config is built (see
+ `get_oauth2_config`), so it already targets the correct cloud provider and
+ account. Only fall back to the AWS endpoint when no URI is configured.
"""
- # For now, fall back to AWS endpoints for token exchange
- # TODO: Improve OAuth2 flow to pass database context to token exchange
from typing import cast
- config = cast(
- "OAuth2ClientConfig",
- dict(config)
- | {"token_request_uri": cls._oauth2_endpoints["aws"]["token_request_uri"]},
- )
+ if not config.get("token_request_uri"):
+ config = cast(
+ "OAuth2ClientConfig",
+ dict(config)
+ | {
+ "token_request_uri": cls._oauth2_endpoints["aws"][
+ "token_request_uri"
+ ]
+ },
+ )
return super().get_oauth2_token(config, code, code_verifier)
@@ -873,18 +877,22 @@ class DatabricksPythonConnectorEngineSpec(DatabricksDynamicBaseEngineSpec):
"""
Exchange authorization code for refresh/access tokens with dynamic endpoint.
- Note: For token exchange, we need the database context from the state.
- This is a limitation of the current OAuth2 flow design.
+ The token request URI is resolved when the OAuth2 config is built (see
+ `get_oauth2_config`), so it already targets the correct cloud provider and
+ account. Only fall back to the AWS endpoint when no URI is configured.
"""
- # For now, fall back to AWS endpoints for token exchange
- # TODO: Improve OAuth2 flow to pass database context to token exchange
from typing import cast
- config = cast(
- "OAuth2ClientConfig",
- dict(config)
- | {"token_request_uri": cls._oauth2_endpoints["aws"]["token_request_uri"]},
- )
+ if not config.get("token_request_uri"):
+ config = cast(
+ "OAuth2ClientConfig",
+ dict(config)
+ | {
+ "token_request_uri": cls._oauth2_endpoints["aws"][
+ "token_request_uri"
+ ]
+ },
+ )
return super().get_oauth2_token(config, code, code_verifier)