Bundle and current-user commands fail with 404 SCIM_404 ("No user found with ID <group-id>") when authenticated as a role (RBAC Public Preview)

Open
  • Is something wrong?
#6,349 2 comments 4 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
45/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
go
Domain
authentication, cli

Research direction

Start with the current-user me command and bundle initialization path that resolve SCIM /Me, then reproduce the failure using a role-scoped profile and bundle validate. Determine whether the CLI can avoid the lookup or must report the role limitation, and cover the chosen behavior with tests; done means role authentication no longer produces an opaque SCIM_404 during the supported workflow.

Written by the indexing model from the issue text.

Description

Describe the issue

When authenticated to a workspace as a role (RBAC Public Preview, where a role is backed by a group) via databricks auth login (selecting the role in the browser flow), any command that resolves the current user fails:

Error: Could not handle request. Failed to getMe in common handler. No user found with ID <group-id>. (404 SCIM_404)
Endpoint: GET https://<workspace-url>/api/2.0/preview/scim/v2/Me?
HTTP Status: 404 Not Found
API error_code: SCIM_404

The ID in the error is the ID of the group backing the assumed role, not a user ID. The SCIM /Me endpoint apparently tries to resolve the caller as a user, but the token principal is a group, so the lookup 404s.

This is not limited to current-user me. All bundle commands (including bundle validate) fail at initialization, because the bundle library unconditionally resolves the current user via SCIM /Me to populate workspace.current_user — even when the bundle configuration does not reference ${workspace.current_user} at all. As a result, Databricks Asset Bundles are entirely unusable when authenticated as a role.

Steps to reproduce

  1. Enable the RBAC preview (account + workspace level) and have Assume permission on a role (group) in the workspace.
  2. databricks auth login --host <workspace-url> -p MAINTAINER and select the role (not the user identity) in the browser.
  3. Run either of:
    • databricks current-user me -p MAINTAINER
    • databricks bundle validate -t prod -p MAINTAINER

Expected behavior

One of:

  • SCIM /Me (and workspace.current_user) resolves to the assumed role's principal (the group), or
  • bundle commands skip current-user resolution when the config does not reference ${workspace.current_user}, or
  • the CLI returns a clear error stating that this operation is unsupported when acting as a role.

Neither the switch-roles docs (which document the CLI login flow) nor the RBAC limitations page mention this limitation. If this is a known backend limitation of the preview, documenting it (and having bundle fail with an actionable message) would already help.

Actual behavior

Error: Could not handle request. Failed to getMe in common handler. No user found with ID <group-id>. (404 SCIM_404)
Endpoint: GET https://<workspace-url>/api/2.0/preview/scim/v2/Me?
HTTP Status: 404 Not Found
API error_code: SCIM_404
API message: Could not handle request. Failed to getMe in common handler. No user found with ID <group-id>.

Environment

  • Databricks CLI version: v1.12.1
  • OS: macOS 26.6.2
  • Cloud: AWS
  • Auth type: OAuth U2M (databricks auth login), role selected in browser
  • RBAC Public Preview: enabled

Additional context

  • Authenticating the same host as my user identity works as expected; only role-scoped tokens fail.
  • Calling the endpoint directly reproduces the error, so the failure is server-side; this issue is about the CLI's hard dependency on /Me making bundles unusable under RBAC:
    databricks api get /api/2.0/preview/scim/v2/Me -p MAINTAINER → same 404 SCIM_404.
  • Related: PR #5822 adds a --group-id flag to assume a group during OAuth login. Once that lands, this bug becomes more visible, since role login gets easier while bundles still cannot run under a role.
Dominant language
Go
Stars
427
Forks
267
Avg merge
2d 1h
Merged PRs (30d)
233

Getting set up

  • Ships a Dockerfile or Docker Compose file
  • Has a pull request template
  • No contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from databricks/cli

All issues in databricks/cli

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.