Conversation
… host metadata Add token_federation_default_oidc_audiences field (List<String>) to HostMetadata and resolve tokenAudience from its first element during config initialization. This takes priority over the existing accountId fallback for account hosts. Co-authored-by: Isaac
tanmay-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
tanmay-db
had a problem deploying
to
test-trigger-is
GitHub Actions
Failure
tanmay-db
changed the title
…ution Test null field, empty list, empty string element, multiple elements (first picked), and null first element. Co-authored-by: Isaac
Co-authored-by: Isaac
tanmay-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
Contributor
|
If integration tests don't run automatically, an authorized user can run them manually by following the instructions below: Trigger: Inputs:
Checks will be approved automatically on success. |
tanmay-db
had a problem deploying
to
test-trigger-is
GitHub Actions
Failure
hectorcast-db
approved these changes
Apr 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Resolves
tokenAudienceautomatically from thetoken_federation_default_oidc_audiencesfield returned by the/.well-known/databricks-confighost metadata endpoint, removing the need for manual audience configuration when using OIDC-based authentication.Why
Today, when using Workload Identity Federation or other OIDC-based credential providers, the
tokenAudiencemust either be explicitly configured by the user or falls back toaccountIdfor account-level hosts. The host metadata endpoint now returns atoken_federation_default_oidc_audiencesfield containing the recommended audience values. Without this change, users must manually configuretokenAudienceeven though the server already advertises the correct value — adding unnecessary friction to OIDC auth setup.This PR reads the new field during config initialization so that the SDK automatically picks up the correct audience from host metadata, with user-configured values still taking priority.
What changed
Interface changes
HostMetadata.getTokenFederationDefaultOidcAudiences()— New getter returningList<String>of OIDC audiences from host metadata.Behavioral changes
tokenAudienceresolution now follows a three-tier priority chain:tokenAudience(highest priority, unchanged)token_federation_default_oidc_audiencesfrom host metadata (new)accountIdfor account hosts (fallback, unchanged)Internal changes
HostMetadata: Addedtoken_federation_default_oidc_audiencesfield (List<String>) with@JsonPropertyannotationDatabricksConfig.resolveHostMetadata(): Added audience resolution logic before the existingaccountIdfallbackNEXT_CHANGELOG.md: Added internal changelog entryHow is this tested?
DatabricksConfigTest.java:testResolveHostMetadataSetsTokenAudienceFromOidcAudiences— verifies audience is resolved from metadatatestResolveHostMetadataDoesNotOverrideExistingTokenAudienceWithOidcAudiences— verifies user-configured audience takes prioritytestResolveHostMetadataOidcAudiencesPriorityOverAccountIdFallback— verifies metadata audience takes priority over accountId fallback