[coverage] Conformance findings: AUTH-019

Open
  • Is something wrong?
#546 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
66/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
go
Domain
databases

Research direction

Start by reading the Go driver’s OAuth M2M scope handling and locate the tests for TestOAuthM2MTokenRequestUsesConfiguredScopes; the issue does not name their paths. Compare configured, whitespace-padded, blank, and unset scopes against the expected token request in the issue. Done when both Thrift and SEA send one sql token for sloppy scopes, and blank or unset scopes request all-apis and complete successfully.

Written by the indexing model from the issue text.

Description

Summary

Surfaced by the multi-language coverage fan-out while conformance-testing these SPEC-IDs against databricks/databricks-sql-go. Each finding is committed as an expected-failure (xfail) test in the coverage PR — the test asserts the CORRECT (post-fix) behavior and stays red until THIS driver (databricks/databricks-sql-go) is fixed, then flips green as a tripwire.

Findings

  • AUTH-019 [thrift]: Thrift OAuth M2M forwards configured scopes verbatim: inner whitespace is not split and duplicates are not dropped (" sql sql " -> two sql tokens), and a whitespace-only entry is sent as-is so the token endpoint rejects the client_credentials grant with invalid_scope instead of falling back to all-apis
    • failing test: TestOAuthM2MTokenRequestUsesConfiguredScopes (see the coverage PR diff under tests/)
  • AUTH-019 [sea]: SEA/kernel OAuth M2M forwards configured scopes verbatim: a scope entry's inner whitespace is not split and duplicates are not dropped, so " sql sql " is sent as two sql tokens instead of one
    • failing test: TestOAuthM2MTokenRequestUsesConfiguredScopes (see the coverage PR diff under tests/)
  • AUTH-019: OAuth M2M forwards configured scopes verbatim: a scope entry's inner whitespace is not split and duplicates are not dropped (" sql sql " is sent as two sql tokens on both thrift and sea), and on the Thrift path a whitespace-only entry is sent as-is so the workspace token endpoint rejects the client_credentials grant with invalid_scope instead of falling back to all-apis (the kernel/SEA path handles the blank entry correctly)

Reproduce & Expected

AUTH-019 — Verifies that the driver's OAuth scopes option decides what the client-credentials (M2M) token request asks for, instead of always requesting all-apis, so a service principal whose secret is scoped…

Reproduce:

SELECT CURRENT_USER() AS user
SELECT CURRENT_USER() AS user
SELECT CURRENT_USER() AS user
SELECT CURRENT_USER() AS user

Expected (per the shared spec):

  • result has exactly 1 row(s)
  • result has exactly 1 row(s)
  • result has exactly 1 row(s)
  • result has exactly 1 row(s)
  • full assertion contract:
result:
- label: configured_scopes
  oauth_token_request_scope_tokens:
    grant_type: client_credentials
    equals:
    - sql
- label: configured_scopes
  row_count: 1
- label: sloppy_scopes
  oauth_token_request_scope_tokens:
    grant_type: client_credentials
    equals:
    - sql
- label: sloppy_scopes
  row_count: 1
- label: blank_scopes
  oauth_token_request_scope_tokens:
    grant_type: client_credentials
    equals:
    - all-apis
- label: blank_scopes
  row_count: 1
- label: unset_scopes
  oauth_token_request_scope_tokens:
    grant_type: client_credentials
    equals:
    - all-apis
- label: unset_scopes
  row_count: 1
protocol:
  thrift:
  - call_min:
      method: OpenSession
      min: 1
  sea:
  - call_min:
      operation: CreateSession
      min: 1

Context

Dominant language
Go
Stars
54
Forks
71
Avg merge
16h 3m
Merged PRs (30d)
21

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from databricks/databricks-sql-go

All issues in databricks/databricks-sql-go

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.