`databricks apps logs` fails with `websocket: bad handshake (HTTP 302 Found)` on an OAuth U2M (`databricks-cli`) profile

Open
  • Is something wrong?
#6,605 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
68/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
go
Domain
authentication, cli

Research direction

Start at the databricks apps logs command and trace the websocket dial to /logz/stream, comparing its credential and headers with the token from databricks auth token. Verify the fix against the reported OAuth U2M profile: the websocket upgrade should succeed and stream JSON log records instead of receiving HTTP 302.

Written by the indexing model from the issue text.

Description

CLI

Versions: Databricks CLI v1.16.0 (Windows, winget) · Azure Databricks workspace · profile auth_type = databricks-cli (U2M, token in the OS keyring)

Repro

databricks apps logs <app-name> --tail-lines 20

Actual: --debug shows the CLI resolving the app and dialing wss://<app>.azure.databricksapps.com/logz/stream, then:

Error: websocket: bad handshake (HTTP 302 Found)

The 302 is the app domain redirecting to /oidc/oauth2/v2.0/authorize, so the credential on the request wasn't accepted.

Expected: the log stream.

Evidence that the app and permissions are fine (same user, same moment):

Request Result
GET https://<app>/logz with Authorization: Bearer $(databricks auth token) 200
GET https://<app>/logz without a token 302 to authorize
websocket upgrade wss://<app>/logz/stream with that bearer + Origin: https://<app> 101; after sending one empty text message, JSON log records stream normally

Forcing the CLI onto the same token as a PAT (DATABRICKS_AUTH_TYPE=pat, DATABRICKS_TOKEN=...) fails differently: Error: OAuth Token not supported for current auth type pat.

So the app domain accepts the workspace token from databricks auth token, but it rejects whatever credential apps logs attaches to its websocket dial.

Workaround: connect to /logz/stream directly with the bearer from databricks auth token, an Origin header, and an initial empty message.

Dominant language
Go
Stars
427
Forks
267
Avg merge
2d 1h
Merged PRs (30d)
233

Getting set up

  • Ships a Dockerfile or Docker Compose file
  • Has a pull request template
  • No contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from databricks/cli

All issues in databricks/cli

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.