Is there a way to refresh tokens issued on behalf of service principal?

[amichel]

I want to be able to refresh tokens generated on behalf of a service principal via Token Management API, just like with any other service where OAuth is used and refresh token endpoint is available.

Allowing indefinite or very long expiration for access tokens is not a great solution and would raise concerns during compliance audits, while shorter expiration means automation pipelines will stop working often, requiring admin user to login via SSO and call the API again to generate a new token.

[Anonymous]

@Alex Michel​ - My name is Piper and I'm one of the moderators for Databricks. Welcome to the community and thank you for your question! Let's give it a while longer to see how the community responds. If nothing is forthcoming, we'll circle back around to this.

[Hubert-Dudek · Accepted solution]

Refresh option would be useful.

In Azure you could use Azure automation to make "refresh" script:

• delete if still exists
• create token via: "databricks tokens create"
• put it to Azure Key Vault with expiration data

[amichel]

Thanks @Hubert Dudek​ 

Appreciate your fast response.

So the idea is to simulate refresh by using the token to authenticate to the api, create new token and then delete itself.

Another issue with Azure specifically, is that Create Service Principal Api in Azure requires Azure AD SP to be created in the first place via app registration, which in turn requires elevated permissions in AAD and using Azure AD Api, not pure Databricks Api