Repos configuration for Azure Service Principal

[pantelis_mare]

Hello community!

I would like to update a repo from within my Azure DevOps release pipeline.

In the pipeline I generate a token using a AAD Service Principal as recommended, and I setup the databricks api using that token.

When I pass the databricks repos update command, I receive an authenitcation error, which is expected and the service principal has not git configured on the workspace side.

My question is:

Can I configure the repos for the SPN programmatically?

Or, is there a way to provide an Azure Devops token when I make the databricks api call? I have tried passing a token by setting the git AZURE_DEVOPS_EXT_PAT but it doesn't seem to work.

Thank you in advance!

[jose_gonzalez]

Hi @Pantelis Maroudis​ ,

Let me reach out to the SME group to get help on your question.

[Srihasa_Akepati · Accepted solution]

@Pantelis Maroudis​ I would like to comment on the Azure SP supportability feature - Updating a databricks repo using Repos API to authenticate using Azure Service Principal AAD is not supported yet. Active work is in progress, We can expect it by Jan 2022.

[pantelis_mare]

Thank you @Srihasa Reddy Akepati​ . Looking forward to it 🙂

[JakeP]

Hello, curious if any update on this? I too would like to use AAD token auth (as service principal) to call repos POST and PATCH from an Azure DevOps pipeline. Thanks!

[pantelis_mare]

Hello @Jake Panchyshyn​ 

From my side I used a separate token generated from account for all steps in my pipeline that needed to use the repos api

[JakeP]

Thanks, though, could you elaborate as to what kind of token you generate as what account or identity? Are you authenticating as a user (rather than service principal) or ??

[pantelis_mare]

Sorry for the late reply @Jake Panchyshyn​ .

Yes, I use a token generated from my account to interact with the repos API in my pipeline. For the rest of the operations (eg job creation) I use the token generated by the service principal

[Kirk1]

Is this supported now given that it is past the Jan 2022 date stated above? Because I have found that a SPN still can't authenticate via AAD.

[venkad]

Looking forward for this update​

[Ben_Templeton__]

@Srihasa Reddy Akepati​  Any update on this?

[Srihasa_Akepati]

@Ben Templeton​ Iam checking internally on the status of this feature. I will update the thread once i receive response.

[Kirk1]

I got this response from Databricks on this topic: "The AAD support depends on Microsoft implementing token exchange for ADO. This is underway but we don't have a timeline for it."

[Martin1337]

Has there been any updates here? Or any viable workaround?​

[FabriceDeseyn]

The solution depends on accepting ServicePrincipal tokens credentials as authentication for ADO. There is mention of it on their roadmap (https://docs.microsoft.com/en-us/azure/devops/release-notes/features-timeline) but no timeline is defined yet.

As a workaround we use a user PAT for the time being.