[coverage] Conformance findings: AUTH-017

Open
  • Is something wrong?
#1,763 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
48/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
java
Domain
authentication, backend

Research direction

Start with the coverage PR diff for testSessionOpenRequestsOneOAuthTokenAndFailsFastOnTokenFailure under tests/, then trace the OAuth token prefetch and session-open flow for the SEA path in this JDBC driver. Reproduce with the specified OAuth endpoint responses and verify the token-failure and token-success assertions, including token and connector-flag request counts and the expected CreateSession calls.

Written by the indexing model from the issue text.

Description

Summary

Surfaced by the multi-language coverage fan-out while conformance-testing these SPEC-IDs against databricks/databricks-jdbc. Each finding is committed as an expected-failure (xfail) test in the coverage PR — the test asserts the CORRECT (post-fix) behavior and stays red until THIS driver (databricks/databricks-jdbc) is fixed, then flips green as a tripwire.

Findings

  • AUTH-017 [sea]: On the SEA path a failed open-time OAuth token request (terminal 401 invalid_client) is swallowed and session-create immediately issues a SECOND token request with no backoff and ignoring Retry-After; the Thrift path correctly sends one (RE-17407)
    • failing test: testSessionOpenRequestsOneOAuthTokenAndFailsFastOnTokenFailure (see the coverage PR diff under tests/)

Reproduce & Expected

AUTH-017 — With OAuth M2M (client-credentials) auth AND a driver identity set — so the open-time connector-service feature-flag prefetch runs and is the first consumer of the auth provider — opening a session m…

Reproduce:

  • Point the OAuth token endpoint at an endpoint that answers every POST with
    HTTP 503 + Retry-After: 60, then attempt one cold open. Count the requests
    that endpoint received.
  • Cold open with a working token endpoint; observe the token, flag, and session requests.

Expected (per the shared spec):

  • completes without an exception
  • [thrift] exactly 0 OpenSession call(s)
  • [thrift] exactly 1 OpenSession call(s)
  • [sea] exactly 0 CreateSession call(s)
  • [sea] exactly 1 CreateSession call(s)
  • full assertion contract:
result:
- label: token_failure
  error:
    contains:
    - '503'
    - service unavailable
    - token
    - oauth
  description: 'The open fails with the TOKEN request''s error (the 503 / token failure),

    not a generic session-create failure and not a silent success.

    '
- label: token_failure
  connection_not_established: true
- label: token_failure
  oauth_token_fetch_count: 1
  description: 'The regression guard: before the fix the prefetch swallowed its token
    failure

    and cached nothing, so session-create immediately sent a SECOND token request

    with no backoff and ignoring `Retry-After`. Exactly one request must be sent.

    '
- label: token_failure
  connector_flag_fetch_count: 0
  description: 'Outcome check outside the core vocabulary (connector-service flag
    GETs seen at

    the proxy): the open aborts at authentication, so the prefetch never runs.

    '
- label: token_success
  no_exception: true
- label: token_success
  oauth_token_fetch_count: 1
  description: "One token serves BOTH the flag prefetch and the session-open request\
    \ \u2014 a\nsuccessful open costs exactly one token request.\n"
- label: token_success
  connector_flag_fetch_count: 1
protocol:
  thrift:
  - label: token_failure
    call_count:
      method: OpenSession
      expected: 0
  - label: token_success
    call_count:
      method: OpenSession
      expected: 1
  - label: token_success
    request_header:
      method: OpenSession
      name: Authorization
      present: true
  sea:
  - label: token_failure
    call_count:
      operation: CreateSession
      expected: 0
  - label: token_success
    call_count:
      operation: CreateSession
      expected: 1
  - label: token_success
    request_header:
      operation: CreateSession
      name: Authorization
      present: true

Context

Dominant language
Java
Stars
41
Forks
49
Avg merge
1d 7h
Merged PRs (30d)
27

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from databricks/databricks-jdbc

All issues in databricks/databricks-jdbc

Similar issues

More Java issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.