Allow OAuth U2M logins to send RFC 8707 resource indicators - #6621
Open
sunishsheth2009 wants to merge 2 commits into
Open
sunishsheth2009 wants to merge 2 commits into
sunishsheth2009 wants to merge 2 commits into
Conversation
Add a repeatable `--resource` flag to `databricks auth login` that sends RFC 8707 resource indicator(s) as `resource` query parameters on the authorization request. This lets the U2M browser flow scope the login to a specific protected resource so the authorization server can drive that resource's own login (e.g. a per-user connection behind an AI Gateway MCP service) before issuing the authorization code. The indicator is threaded through PersistentAuth via WithResources and appended to the authorization endpoint URL, preserving any query the endpoint already carries; the oauth2 library appends its own parameters after. The flag requires `--host` (added to the discovery-incompatible flag list) since it targets a specific workspace's /oidc. Co-authored-by: Isaac <no-reply@databricks.com>
Co-authored-by: Isaac <no-reply@databricks.com>
Contributor
|
An authorized user can trigger integration tests manually by following the instructions below: Trigger: Inputs:
Checks will be approved automatically on success. |
This was referenced Sep 10, 2026
Open
sunishsheth2009
added a commit
to sunishsheth2009/ucode
that referenced
this pull request
Sep 10, 2026
Give every coding agent a working login flow for connection-backed AI Gateway mcp-services endpoints, done in the stdio proxy every agent already spawns — no new library (cf. mcp-remote) and no per-agent OAuth app. When AI Gateway has no per-user connection credential it answers with HTTP 401 (RFC 9728). The proxy's httpx auth hook already sees every response, so on a 401 for a connection-backed URL it runs the Databricks CLI U2M login with an RFC 8707 resource indicator (`databricks auth login --resource <mcp-url>`, using the CLI's own registered redirect — no --client-id), then retries with a fresh token. A resource-aware /oidc drives the connection's SaaS login before minting the token, so the retry succeeds — transparently to the agent, which just sees the request authenticate rather than a failed tools/list. A later credential revoke re-triggers the login on the next 401. New module mcp_connection_login holds connection_from_url + run_connection_login; mcp_proxy._build_token_auth gains the login-on-401 retry. Unit-tested. Depends on the CLI --resource flag (databricks/cli#6621) and /oidc resource handling (login). Co-authored-by: Isaac <no-reply@databricks.com>
sunishsheth2009
marked this pull request as ready for review
September 11, 2026 04:05
Contributor
Approval status: pending
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Changes
Add a repeatable
--resourceflag todatabricks auth loginthat sends RFC 8707 resource indicator(s) asresourcequery parameters on the OAuth authorization request. Threaded throughu2m.PersistentAuthvia a newWithResourcesoption, appended to the authorization endpoint URL (preserving any query the endpoint already carries; theoauth2library appendsclient_id/PKCE/etc. after). Requires--host(added to the discovery-incompatible flag list), since a resource indicator targets a specific workspace's/oidc.Example:
produces:
Why
Builds on #6594 (
--client-id). A resource-aware authorization server can use theresourceindicator to scope the login to a specific protected resource and drive that resource's own login before issuing the authorization code — e.g. a per-user connection credential behind an AI Gateway MCP service (system.ai.github), where the user must complete a downstream SaaS login the first time. Without the indicator the authorization server only seesclient_id+ user, not which connection the flow is for.This is a draft / POC to enable end-to-end validation of that flow; the resource indicator is currently sent on the authorization request only (not the token exchange).
Tests
TestPersistentAuthResources— none / single / multipleresourceparams appear on the built authorize URL.TestValidateDiscoveryFlagCompatibility—--resourcerequires--host.go test ./libs/auth/u2m/ ./cmd/auth/pass;go vetclean;gofmtclean.This pull request and its description were written by Isaac.