Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Bundle and current-user commands fail with 404 SCIM_404 ("No user found with ID <group-id>") when authenticated as a role (RBAC Public Preview)

Aperta
  • Qualcosa non va?
#6,349 0 commenti 2 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
45/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
go
Ambito
authentication, cli

Direzione di ricerca

Inizia con il comando current-user me e il percorso di inizializzazione del bundle che risolvono SCIM /Me, quindi riproduci il fallimento usando un profilo con ambito di ruolo e bundle validate. Determina se la CLI può evitare la ricerca o deve segnalare la limitazione del ruolo, e copri con test il comportamento scelto; il lavoro è completato quando l’autenticazione del ruolo non produce più uno SCIM_404 opaco durante il workflow supportato.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Describe the issue

When authenticated to a workspace as a role (RBAC Public Preview, where a role is backed by a group) via databricks auth login (selecting the role in the browser flow), any command that resolves the current user fails:

Error: Could not handle request. Failed to getMe in common handler. No user found with ID <group-id>. (404 SCIM_404)
Endpoint: GET https://<workspace-url>/api/2.0/preview/scim/v2/Me?
HTTP Status: 404 Not Found
API error_code: SCIM_404

The ID in the error is the ID of the group backing the assumed role, not a user ID. The SCIM /Me endpoint apparently tries to resolve the caller as a user, but the token principal is a group, so the lookup 404s.

This is not limited to current-user me. All bundle commands (including bundle validate) fail at initialization, because the bundle library unconditionally resolves the current user via SCIM /Me to populate workspace.current_user — even when the bundle configuration does not reference ${workspace.current_user} at all. As a result, Databricks Asset Bundles are entirely unusable when authenticated as a role.

Steps to reproduce

  1. Enable the RBAC preview (account + workspace level) and have Assume permission on a role (group) in the workspace.
  2. databricks auth login --host <workspace-url> -p MAINTAINER and select the role (not the user identity) in the browser.
  3. Run either of:
    • databricks current-user me -p MAINTAINER
    • databricks bundle validate -t prod -p MAINTAINER

Expected behavior

One of:

  • SCIM /Me (and workspace.current_user) resolves to the assumed role's principal (the group), or
  • bundle commands skip current-user resolution when the config does not reference ${workspace.current_user}, or
  • the CLI returns a clear error stating that this operation is unsupported when acting as a role.

Neither the switch-roles docs (which document the CLI login flow) nor the RBAC limitations page mention this limitation. If this is a known backend limitation of the preview, documenting it (and having bundle fail with an actionable message) would already help.

Actual behavior

Error: Could not handle request. Failed to getMe in common handler. No user found with ID <group-id>. (404 SCIM_404)
Endpoint: GET https://<workspace-url>/api/2.0/preview/scim/v2/Me?
HTTP Status: 404 Not Found
API error_code: SCIM_404
API message: Could not handle request. Failed to getMe in common handler. No user found with ID <group-id>.

Environment

  • Databricks CLI version: v1.12.1
  • OS: macOS 26.6.2
  • Cloud: AWS
  • Auth type: OAuth U2M (databricks auth login), role selected in browser
  • RBAC Public Preview: enabled

Additional context

  • Authenticating the same host as my user identity works as expected; only role-scoped tokens fail.
  • Calling the endpoint directly reproduces the error, so the failure is server-side; this issue is about the CLI's hard dependency on /Me making bundles unusable under RBAC:
    databricks api get /api/2.0/preview/scim/v2/Me -p MAINTAINER → same 404 SCIM_404.
  • Related: PR #5822 adds a --group-id flag to assume a group during OAuth login. Once that lands, this bug becomes more visible, since role login gets easier while bundles still cannot run under a role.
Lingua principale
Go
Stelle
404
Fork
246
Merge medio
1g 10h
PR unite (30g)
225

Preparare l'ambiente

  • Include un Dockerfile o un file Docker Compose
  • Ha un modello di pull request
  • Nessuna guida per i contributori

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di databricks/cli

Tutte le issue di databricks/cli

Issue simili

Altre issue su Go

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.