Re: Oauth Token federation

saurabh18cs · ‎10-02-2025

I used to generate oauth token for databricks for my service principal using azure devops pipeline in this manner, see if this token can help you (DATABRICKS_TOKEN) which you can then use in next stages. I generate this token on sp to authenticate towards databricks so when i deploy job it should use this sp identity and not the one running on agent:

- stage : Create_oauth_token

condition : succeeded()

jobs :

- job : oauth_bearer_token_sp

steps:

- script: |

wget https://github.com/stedolan/jq/releases/download/jq-1.6/jq-linux32 -O $(Build.Repository.LocalPath)/jq

chmod +x $(Build.Repository.LocalPath)/jq

displayName: Install jq

condition: succeeded()

- script: |

if [[ ${{ variables.env}} -eq 'dev' ]]

then

CLIENT_ID=${{ parameters.sp_app_id_dev}}

CLIENT_SECRET=$SP_SECRET_DEV

DATABRICKS_WORKSPACE_URL=${{ parameters.databricks_wrkspc_url_dev}}

elif [[ ${{ variables.env}} -eq 'acc' ]]

then

CLIENT_ID=${{ parameters.sp_app_id_acc}}

CLIENT_SECRET=$SP_SECRET_ACC

DATABRICKS_WORKSPACE_URL=${{ parameters.databricks_wrkspc_url_acc}}

else

CLIENT_ID=${{ parameters.sp_app_id_prd}}

CLIENT_SECRET=$SP_SECRET_PRD

DATABRICKS_WORKSPACE_URL=${{ parameters.databricks_wrkspc_url_prd}}

fi

DATABRICKS_URL="$DATABRICKS_WORKSPACE_URL/api/2.0/token/create"

access_token_val=$(curl -X POST -H 'Content-Type: application/x-www-form-urlencoded' \

https://login.microsoftonline.com/af73baa8-f5xxxxxxxxxxxxxxxxxxx/oauth2/v2.0/token \

-d "client_id=$CLIENT_ID" \

-d 'grant_type=client_credentials'\

-d 'scope=2ff814a6-3304-4ab8-85cb-cd0e6f879c1d%2F.default' \

-d "client_secret=$CLIENT_SECRET")

access_token=$(jq -r '.access_token' <<< "$access_token_val")

echo $access_token

api_response=$(curl -X POST $DATABRICKS_URL \

-H "Authorization: Bearer $access_token" \

-H "X-Databricks-Azure-SP-Management-Token:$access_token" \

-d '{"comment": "pipeline token"}')

echo "$api_response"

DATABRICKS_NEW_TOKEN=$(jq -r '.token_value' <<< "$api_response")

if [ -z "${DATABRICKS_NEW_TOKEN}" ]

then

echo "Token could not be created"

exit 1

else

echo "Successfully created a Databricks Token"

echo "##vso[task.setvariable variable=DATABRICKS_TOKEN;isOutput=true]$DATABRICKS_NEW_TOKEN"

echo "##vso[task.setvariable variable=ACCESS_TOKEN;isOutput=true]$access_token"

fi

displayName: 'Create oauth token'

name: oauth

condition: succeeded()