[yolocs]

Changes

databricks auth docker configure no longer fails when several databricks-cli profiles match the selected workspace. It configures Docker and prints a warning:

Warning: multiple Databricks profiles match workspace ID 1234567890123456: dev, prod. Docker credential helper uses the first logged-in profile in this order

databricks auth docker token (the Docker credential helper) tries the matching profiles in profile order ([DEFAULT] first, then file order) and uses the first one that is logged in. It skips a profile only when it has no cached login, no refresh token, or a rejected refresh token. Any other error (network, server, timeout, cancellation) is returned, so the helper never switches identity because of a transient failure. A single matching profile behaves as before, including its error text.

To tell a cache miss apart from other errors, loadToken now keeps storage.ErrNotFound in its error chain via storage.NewNotFoundHint. databricks auth token messages are unchanged.

Why

Docker gives the credential helper only the registry host, which encodes the workspace ID, so the helper maps it back to a profile by workspace_id. auth login now saves workspace_id on every profile, so two logins to the same workspace were enough to block auth docker configure.

This replaces the "remove the duplicate profile" hint from #7363, which has not been released, so that changelog fragment is removed.

Tests

• Unit: TestProfilesForRegistry and TestTokenForRegistry cover first-wins, skipping each logged-out case, stopping on other errors and on cancellation, and the unchanged single-profile path. TestToken_loadToken now asserts that ErrNotFound and ErrMissingRefreshToken stay in the error chain.
• Acceptance: updated cmd/auth/docker/{configure,configure-errors,token,help}. Configure warns and succeeds when profiles share a workspace. Token picks the first logged-in profile (the two profiles have different cached tokens), skips a logged-out profile on the default force-refresh path, and lists every profile when none is logged in.
• go test ./cmd/auth/... ./libs/dockercredentials/... ./libs/auth/... ./libs/databrickscfg/... and go test ./acceptance -run TestAccept/cmd/auth pass. Lint, deadcode, and whitespace checks pass.

This pull request and its description were written by Isaac.

[github-actions]

Commit: 79702a72b | Workflow run

Regression test report

Selected 4 changed tests (limit=20, 0 not selected)

4 tests: regression=3 unreleased=0 coverage=1 failing=0

test	branch	main (c461a8f)	latest (v1.24.0)
TestAccept/cmd/auth/docker/configure	✅	❌	❌
TestAccept/cmd/auth/docker/configure-errors	✅	✅	✅
TestAccept/cmd/auth/docker/help	✅	❌	❌
TestAccept/cmd/auth/docker/token	✅	❌	❌

TestAccept/cmd/auth/docker/configure: branch ✅ | main (c461a8f) ❌ | latest (v1.24.0) ❌

main (c461a8f):

acceptance_test.go:1345: Diff:
        --- cmd/auth/docker/configure/output.txt
        +++ /tmp/TestAcceptcmdauthdockerconfigure106800780/002/output.txt
        @@ -158,24 +158,6 @@
         === Profiles sharing the workspace
         
         >>> databricks auth docker configure docker-test
        -Warning: multiple Databricks profiles match workspace ID [WORKSPACE_ID]: docker-test, shared. Docker credential helper uses the first logged-in profile in this order
        -Configured Docker credential helper for [WORKSPACE_ID].container.us-west-2.localhost
        -Updated Docker config: [TEST_TMP_DIR]/home/docker/config.json
        -Installed Docker credential helper: [TEST_TMP_DIR]/home/bin/docker-credential-databricks
        +Error: multiple Databricks profiles match workspace ID [WORKSPACE_ID]: docker-test and shared. Docker credential helper requires exactly one profile per workspace. Remove the duplicate profile with: databricks auth logout --profile <profile-name> --delete
         
        ->>> print_requests.py --get //api
        -{
        -  "headers": {
        -    "X-Databricks-Workspace-Id": [
        -      "[WORKSPACE_ID]"
        -    ]
        -  },
        -  "method": "GET",
        -  "path": "/api/2.1/unity-catalog/metastore_summary"
        -}
        -
        ->>> docker-credential-databricks get
        -{
        -  "Secret": "oauth-token",
        -  "Username": "oauthtoken"
        -}
        +Exit code: 1
        
    acceptance_test.go:1123: 
        LOG.configure-again: Configured Docker credential helper for 900800700600.container.us-west-2.localhost
        LOG.configure-again: Updated Docker config: /tmp/TestAcceptcmdauthdockerconfigure106800780/001/home/docker/config.json
        LOG.configure-again: Installed Docker credential helper: /tmp/TestAcceptcmdauthdockerconfigure106800780/001/home/bin/docker-credential-databricks

latest (v1.24.0):

acceptance_test.go:1345: Diff:
        --- cmd/auth/docker/configure/output.txt
        +++ /tmp/TestAcceptcmdauthdockerconfigure2182085737/002/output.txt
        @@ -158,24 +158,6 @@
         === Profiles sharing the workspace
         
         >>> databricks auth docker configure docker-test
        -Warning: multiple Databricks profiles match workspace ID [WORKSPACE_ID]: docker-test, shared. Docker credential helper uses the first logged-in profile in this order
        -Configured Docker credential helper for [WORKSPACE_ID].container.us-west-2.localhost
        -Updated Docker config: [TEST_TMP_DIR]/home/docker/config.json
        -Installed Docker credential helper: [TEST_TMP_DIR]/home/bin/docker-credential-databricks
        +Error: multiple Databricks profiles match workspace ID [WORKSPACE_ID]: docker-test and shared. Remove duplicate workspace_id entries before using Docker credential helper
         
        ->>> print_requests.py --get //api
        -{
        -  "headers": {
        -    "X-Databricks-Workspace-Id": [
        -      "[WORKSPACE_ID]"
        -    ]
        -  },
        -  "method": "GET",
        -  "path": "/api/2.1/unity-catalog/metastore_summary"
        -}
        -
        ->>> docker-credential-databricks get
        -{
        -  "Secret": "oauth-token",
        -  "Username": "oauthtoken"
        -}
        +Exit code: 1
        
    acceptance_test.go:1123: 
        LOG.configure-again: Configured Docker credential helper for 900800700600.container.us-west-2.localhost
        LOG.configure-again: Updated Docker config: /tmp/TestAcceptcmdauthdockerconfigure2182085737/001/home/docker/config.json
        LOG.configure-again: Installed Docker credential helper: /tmp/TestAcceptcmdauthdockerconfigure2182085737/001/home/bin/docker-credential-databricks

TestAccept/cmd/auth/docker/help: branch ✅ | main (c461a8f) ❌ | latest (v1.24.0) ❌

main (c461a8f):

acceptance_test.go:1345: Diff:
        --- cmd/auth/docker/help/output.txt
        +++ /tmp/TestAcceptcmdauthdockerhelp879007143/002/output.txt
        @@ -65,13 +65,11 @@
         This command installs docker-credential-databricks and configures Docker to use
         it for the selected workspace's Artifact Registry host. If the selected profile
         does not already include a workspace_id, the command resolves and saves it so
        -the Docker helper can map the registry host back to the profile. If several
        -profiles match the workspace, the helper uses the first logged-in one, checking
        -[DEFAULT] first and then the others in file order. The registry region is
        -inferred from the workspace's metastore. Select the workspace with [PROFILE] or
        ---profile; --host, --account-id, and --workspace-id are not supported. The
        -deprecated --region flag is retained for compatibility; omit it because it will
        -be fully removed in the next release.
        +the Docker helper can map the registry host back to the profile. The registry
        +region is inferred from the workspace's metastore. Select the workspace with
        +[PROFILE] or --profile; --host, --account-id, and --workspace-id are not
        +supported. The deprecated --region flag is retained for compatibility; omit it
        +because it will be fully removed in the next release.
         
         Usage:
           databricks auth docker configure [PROFILE] [flags]

latest (v1.24.0): same output as main (c461a8f)

TestAccept/cmd/auth/docker/token: branch ✅ | main (c461a8f) ❌ | latest (v1.24.0) ❌

main (c461a8f):

acceptance_test.go:1345: Diff:
        --- cmd/auth/docker/token/output.txt
        +++ /tmp/TestAcceptcmdauthdockertoken406480174/002/output.txt
        @@ -54,22 +54,6 @@
         === Multiple profiles for the workspace use the first logged-in profile
         
         >>> [CLI] auth docker token --no-force-refresh
        -{
        -  "Secret": "docker-test-access-token",
        -  "Username": "oauthtoken"
        -}
        +Error: multiple Databricks profiles match workspace ID [WORKSPACE_ID]: docker-test and duplicate. Docker credential helper requires exactly one profile per workspace. Remove the duplicate profile with: databricks auth logout --profile <profile-name> --delete
         
        -=== Profiles that are not logged in are skipped
        -
        ->>> [CLI] auth docker token
        -{
        -  "Secret": "oauth-token",
        -  "Username": "oauthtoken"
        -}
        -
        -=== No logged-in profile for the workspace
        -
        ->>> musterr [CLI] auth docker token
        -Error: no logged-in Databricks profile for workspace ID 555666777 from registry host 555666777.container.us-west-2.localhost. Run databricks auth login --profile <profile-name> for one of these profiles:
        -profile "logged-out-a": cache: databricks OAuth is not configured for this host. no cached credentials; run `databricks auth login` to sign in
        -profile "logged-out-b": cache: databricks OAuth is not configured for this host. no cached credentials; run `databricks auth login` to sign in
        +Exit code: 1
        
FAIL

latest (v1.24.0):

acceptance_test.go:1345: Diff:
        --- cmd/auth/docker/token/output.txt
        +++ /tmp/TestAcceptcmdauthdockertoken76492296/002/output.txt
        @@ -54,22 +54,6 @@
         === Multiple profiles for the workspace use the first logged-in profile
         
         >>> [CLI] auth docker token --no-force-refresh
        -{
        -  "Secret": "docker-test-access-token",
        -  "Username": "oauthtoken"
        -}
        +Error: multiple Databricks profiles match workspace ID [WORKSPACE_ID]: docker-test and duplicate. Remove duplicate workspace_id entries before using Docker credential helper
         
        -=== Profiles that are not logged in are skipped
        -
        ->>> [CLI] auth docker token
        -{
        -  "Secret": "oauth-token",
        -  "Username": "oauthtoken"
        -}
        -
        -=== No logged-in profile for the workspace
        -
        ->>> musterr [CLI] auth docker token
        -Error: no logged-in Databricks profile for workspace ID 555666777 from registry host 555666777.container.us-west-2.localhost. Run databricks auth login --profile <profile-name> for one of these profiles:
        -profile "logged-out-a": cache: databricks OAuth is not configured for this host. no cached credentials; run `databricks auth login` to sign in
        -profile "logged-out-b": cache: databricks OAuth is not configured for this host. no cached credentials; run `databricks auth login` to sign in
        +Exit code: 1
        
FAIL

[eng-dev-ecosystem-bot]

✅ Integration test report

Commit: 79702a7

Run: 42119559939

	Env	🔄​flaky	✅​pass	🙈​skip	Time
✅​	aws linux-2core-8gb		271	19	5:32
✅​	aws-windows-latest-4core-16gb		273	17	2:45
✅​	azure linux-2core-8gb		270	19	5:16
✅​	azure-windows-latest-4core-16gb		272	17	2:32
✅​	gcp linux-2core-8gb		271	19	5:22
🔄​	gcp-windows-latest-4core-16gb	2	271	17	2:50

	Test Name	gcp-windows-latest-4core-16gb
🔄​	TestFilerWorkspaceNotebook	🔄​f
🔄​	TestFilerWorkspaceNotebook/sqlJupyterNotebook.ipynb	🔄​f

Top 3 slowest tests (at least 2 minutes):

duration	env	testname
3:57	azure linux-2core-8gb	TestAccept
3:54	gcp linux-2core-8gb	TestAccept
3:54	aws linux-2core-8gb	TestAccept

[pietern]

This can have unintended side effects. Let's say you configure Docker assuming profile B, but profile A is earlier in the .databrickscfg for the same workspace host. What happens? Does a docker push use profile A?

I recommend using the "default profile" switcher (run databricks auth switch to see what happens) to be the tie-breaker, if it exists, and keep the error otherwise.