Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
12-03-2025 01:50 PM - edited 12-03-2025 01:52 PM
I recently ran into a similar issue attempting to deploy with the Terraform Databricks provider:
provider "databricks" {
host = <host>
azure_workspace_resource_id = <workspace_resource_id>
azure_client_id = <azure_client_id>
azure_client_secret = <azure_client_secret>
azure_tenant_id = <tenant_id>
}
And locally the deployment worked just fine, but the exact same code via Github actions resulted in:
> Failed during request visitor: error getting token: AADSTS70025: The client '<client-id>'(<client-name>) has no configured federated identity credentials
The solution was to set an environment variable for the github action:
env:
DATABRICKS_AUTH_TYPE: azure-client-secret
GitHub Actions provides OIDC tokens automatically, and the Databricks provider has built-in logic to detect and prefer OIDC/federated identity when available. Even though your provider configuration explicitly sets azure_client_id and azure_client_secret, the provider was detecting GitHub's OIDC environment and trying that first - which failed because your environment-specific SP doesn't have federated identity credentials configured.
The DATABRICKS_AUTH_TYPE environment variable explicitly tells the Databricks provider which authentication method to use. By setting it to azure-client-secret, we force it to use the traditional Azure Service Principal authentication with client_id/client_secret, and prevent it from auto-detecting and trying to use GitHub Actions OIDC tokens.
