naiduv opened a new pull request, #44203: URL: https://github.com/apache/superset/pull/44203
### SUMMARY Add per-database Databricks service-principal auth via Encrypted Extra (`client_id` / `client_secret`), so a SQL warehouse can be connected without a personal access token. - Native M2M injects a `credentials_provider` (`databricks-sdk`) in `update_params_from_encrypted_extra`. - Azure Entra M2M sets `auth_type=azure-sp-m2m` and does not require `databricks-sdk`. - PAT remains the default; existing per-user OAuth impersonation is unchanged. - `client_secret` is masked; `oauth2_client_info` is still stripped from driver kwargs. Addresses https://github.com/apache/superset/discussions/39405 ### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF N/A ### TESTING INSTRUCTIONS - [ ] PAT-only Databricks connection still works (no Encrypted Extra). - [ ] Encrypted Extra with `auth_method=oauth-m2m`, `client_id`, and `client_secret`: leave Access token blank (or `m2m`); Test Connection succeeds against a SQL warehouse. - [ ] `client_secret` is masked when editing the database. - [ ] Missing `client_id` or `client_secret` with `auth_method=oauth-m2m` fails with a clear error. - [ ] Azure path: `auth_method=azure-sp-m2m` does not require `databricks-sdk`. - [ ] SQL Lab: `SELECT current_user()` runs as the service principal. ### ADDITIONAL INFORMATION - [x] Has associated issue: https://github.com/apache/superset/discussions/39405 - [ ] Required feature flags: - [ ] Changes UI - [ ] Includes DB Migration - [x] Introduces new feature or API - [ ] Removes existing feature or API -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
