Bundle and current-user commands fail with 404 SCIM_404 ("No user found with ID <group-id>") when authenticated as a role (RBAC Public Preview)

Aberta
  • Algo errado?
#6,349 1 comentário 3 reações 0 responsáveis Ver no GitHub

Mantenedores costumam responder em até 1 dia

Ninguém assumiu esta issue ainda.

Avaliação

Dificuldade
4/5
Tempo estimado
3-5 dias
Facilidade para iniciantes
45/100
Tipo de issue
Bug
Clareza
Razoavelmente clara
Status de atividade
Ativa
Stack de tecnologia
go
Domínio
authentication, cli

Direção de pesquisa

Comece com o comando current-user me e o caminho de inicialização do bundle que resolvem SCIM /Me, depois reproduza a falha usando um perfil com escopo de função e bundle validate. Determine se a CLI pode evitar a busca ou precisa informar a limitação da função, e cubra o comportamento escolhido com testes; considera-se concluído quando a autenticação da função não produzir mais um SCIM_404 opaco durante o fluxo de trabalho compatível.

Escrita pelo modelo de indexação a partir do texto da issue.

Descrição

Stale

Describe the issue

When authenticated to a workspace as a role (RBAC Public Preview, where a role is backed by a group) via databricks auth login (selecting the role in the browser flow), any command that resolves the current user fails:

Error: Could not handle request. Failed to getMe in common handler. No user found with ID <group-id>. (404 SCIM_404)
Endpoint: GET https://<workspace-url>/api/2.0/preview/scim/v2/Me?
HTTP Status: 404 Not Found
API error_code: SCIM_404

The ID in the error is the ID of the group backing the assumed role, not a user ID. The SCIM /Me endpoint apparently tries to resolve the caller as a user, but the token principal is a group, so the lookup 404s.

This is not limited to current-user me. All bundle commands (including bundle validate) fail at initialization, because the bundle library unconditionally resolves the current user via SCIM /Me to populate workspace.current_user — even when the bundle configuration does not reference ${workspace.current_user} at all. As a result, Databricks Asset Bundles are entirely unusable when authenticated as a role.

Steps to reproduce

  1. Enable the RBAC preview (account + workspace level) and have Assume permission on a role (group) in the workspace.
  2. databricks auth login --host <workspace-url> -p MAINTAINER and select the role (not the user identity) in the browser.
  3. Run either of:
    • databricks current-user me -p MAINTAINER
    • databricks bundle validate -t prod -p MAINTAINER

Expected behavior

One of:

  • SCIM /Me (and workspace.current_user) resolves to the assumed role's principal (the group), or
  • bundle commands skip current-user resolution when the config does not reference ${workspace.current_user}, or
  • the CLI returns a clear error stating that this operation is unsupported when acting as a role.

Neither the switch-roles docs (which document the CLI login flow) nor the RBAC limitations page mention this limitation. If this is a known backend limitation of the preview, documenting it (and having bundle fail with an actionable message) would already help.

Actual behavior

Error: Could not handle request. Failed to getMe in common handler. No user found with ID <group-id>. (404 SCIM_404)
Endpoint: GET https://<workspace-url>/api/2.0/preview/scim/v2/Me?
HTTP Status: 404 Not Found
API error_code: SCIM_404
API message: Could not handle request. Failed to getMe in common handler. No user found with ID <group-id>.

Environment

  • Databricks CLI version: v1.12.1
  • OS: macOS 26.6.2
  • Cloud: AWS
  • Auth type: OAuth U2M (databricks auth login), role selected in browser
  • RBAC Public Preview: enabled

Additional context

  • Authenticating the same host as my user identity works as expected; only role-scoped tokens fail.
  • Calling the endpoint directly reproduces the error, so the failure is server-side; this issue is about the CLI's hard dependency on /Me making bundles unusable under RBAC:
    databricks api get /api/2.0/preview/scim/v2/Me -p MAINTAINER → same 404 SCIM_404.
  • Related: PR #5822 adds a --group-id flag to assume a group during OAuth login. Once that lands, this bug becomes more visible, since role login gets easier while bundles still cannot run under a role.
Linguagem predominante
Go
Estrelas
416
Forks
256
Merge médio
1d 22h
PRs com merge (30d)
206

Preparar o ambiente

  • Inclui um Dockerfile ou arquivo Docker Compose
  • Tem um modelo de pull request
  • Sem guia de contribuição

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de databricks/cli

Todas as issues de databricks/cli

Issues semelhantes

Mais issues de Go

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.