topic Re: Generating Personal Access Token to service principle databricks cli in Data Engineering

Generating Personal Access Token to service principle databricks cli

pedrojunqueira — Tue, 18 Jun 2024 21:35:37 GMT

Hi I am having issues generating personal access token to my service principle.

I followed the steps from here

my `~/.databrickscfg` has the following

```

[my-profile-name]
host = <account-console-url>
account_id = <account-id>
azure_tenant_id = <azure-service-principal-tenant-id>
azure_client_id = <azure-service-principal-application-id>
azure_client_secret = <azure-service-principal-client-secret>

```

then if I do the command

`databricks tokens create --comment <comment> --lifetime-seconds <lifetime-seconds> -p my-profile-name`

it DOES generates a token BUT to my user authenticated (my email)

then I try to do any other command to deploy dabs (Databricks Asset Bundle) and it always default to my authenticated user.

like if I do a [EDITED]

`databricks bundle deploy --profile my-profile-name`

then it deploys to my user not what I specified in the profile...

```

Name: python_package
Target: dev
Workspace:
Host: https://adb-1666302976490045.5.azuredatabricks.net
User: pedrocj@gmail.com
Path: /Users/pedrocj@gmail.com/.bundle/python_package/dev

Validation OK!

```

I would expect to validate or deploy to my service principle that is defined in the `~/.databrickscfg`

I added the service principle to be a workspace adm and give all the associated permissions in the the account console.

what I am doing wrong?

Cheers

Pedro

PS: I did it couple of days ago and all works like a charm. But now It is not working.

Re: Generating Personal Access Token to service principle databricks cli

Walter_C — Wed, 19 Jun 2024 18:05:12 GMT

Hello Pedro, you can create tokens on behalf service principal by running command on CLI:

databricks token-management create-obo-token <application-id> --lifetime-seconds <lifetime-seconds> --comment <comment> -p <profile-name>

Or by API call https://docs.databricks.com/api/workspace/tokenmanagement/createobotoken

The command you are running is only set for user PAT token, this is why it authenticates with your user.

Re: Generating Personal Access Token to service principle databricks cli

pedrojunqueira — Sun, 23 Jun 2024 10:49:35 GMT

Hi Walter,

Thanks for the reply. I have not tried your method but will accept as an alternative solution. What end up working for me was to to a machine-to-machine authentication with the service principal and generating a token from the

authenticated used.

Had to have the profile configured as

[your-sp-profile-name]
host = https://<host>.azuredatabricks.net
client_id = <appId>
client_secret = <service principle Oauth Token>

Then to generate a pat just do

databricks tokens create --comment dab -p your-sp-profile-name

Docs for azure is here

Re: Generating Personal Access Token to service principle databricks cli

PabloCSD — Tue, 24 Sep 2024 21:13:12 GMT

I want something similar, to use a service principal token instead of a PAT, have you ever done this?

https://community.databricks.com/t5/administration-architecture/use-a-service-principal-token-instead-of-personal-access-token/m-p/91629

Re: Generating Personal Access Token to service principle databricks cli

dataeng42io — Wed, 25 Sep 2024 03:59:06 GMT

Hi @PabloCSD I will reply in your original post about how you may be able to resolve this issue.

Regards

Pedro

Re: Generating Personal Access Token to service principle databricks cli

sutariya_98 — Thu, 03 Apr 2025 11:24:27 GMT

Attention: It only works in AWS and GCP but don't work in Azure.