[coverage] Conformance findings: AUTH-011

[peco-engineer-bot]

Summary

Surfaced by the multi-language coverage fan-out while conformance-testing these SPEC-IDs against databricks/databricks-sql-python. Each finding is committed as an expected-failure (xfail) test in the coverage PR — the test asserts the CORRECT (post-fix) behavior and stays red until THIS driver (databricks/databricks-sql-python) is fixed, then flips green as a tripwire.

Findings

• AUTH-011 [thrift]: TokenFederationProvider sends grant_type=...token-exchange with a plain client_id instead of the jwt-bearer grant with identity_federation_client_id; that spelling does not select service-principal-wide WIF, so SP federation can silently fall back to account-wide federation
  • failing test: test_service_principal_level_identity_federation_github_oidc (see the coverage PR diff under tests/)
• AUTH-011 [sea]: Same shared TokenFederationProvider defect on the kernel/SEA path (reached via auth_bridge._is_pat): exchange uses grant_type=...token-exchange + plain client_id rather than jwt-bearer + identity_federation_client_id, so SP-wide WIF is not actually selected
  • failing test: test_service_principal_level_identity_federation_github_oidc (see the coverage PR diff under tests/)
• AUTH-011: TokenFederationProvider sends grant_type=urn:ietf:params:oauth:grant-type:token-exchange with a plain client_id instead of the jwt-bearer grant with identity_federation_client_id; the client_id spelling does not select service-principal-wide workload identity federation, so a connection configured for SP federation can silently fall back to account-wide federation

Reproduce & Expected

AUTH-011 — Verifies service principal-level workload identity federation using a GitHub OIDC ID token.

Reproduce:

SELECT CURRENT_USER() AS user

Expected (per the shared spec):

• {'thrift_call_count': {'method': 'OpenSession', 'expected': 1}}
• POST /oauth/token/calls/verify with {grant_type:"urn:ietf:params:oauth:grant-type:jwt-bearer"} returned {"verified": true}. # Assert.True(verifyResponse.GetProperty("verified").GetBoolean())
• GET /oauth/token/calls → find last entry where grant_type==jwt-bearer AND access_token present. # Assert.False(string.IsNullOrEmpty(exchangedToken))
• The captured jwt-bearer exchange REQUEST body (form-encoded) must carry identity_federation_client_id equal to the configured value — the observable proof that the connection-level option reached the wire and selected SP-wide WIF instead of BYOT / account-wide WIF. Omitting the option must leave the parameter off the wire (that is AUTH-010's account-level path).
• {'exchanged_jwt_readable': True}
• jwt.Issuer normalized (strip scheme + path) must equal workspace hostname. Normalization: issuer.Replace("https://","").Replace("http://","").Split('/')[0] Expected: TestConfig.HostName OR new Uri(TestConfig.Uri).Host # Assert.Equal(expectedHost, issuerHost)
• {'not_null': 'result'}
• {'not_null': 'batch'}
• {'row_count': 1}
• {'not_null': 'batch.Column(0)'}

Context

• The behavior was first fixed in a DIFFERENT driver — reference PR: https://github.com/databricks/databricks-sql-kernel/pull/248 — which seeded the shared language-neutral spec. This issue tracks the same conformance gap in databricks/databricks-sql-python; the reference PR is for cross-referencing the intended behavior, NOT a change to this repo.
• Coverage PR carrying the reproducing xfail test(s): https://github.com/databricks/databricks-driver-test/pull/1289