Description
The service principal access acoount admin access and also have a contribuor role on access connector but still encountering permission 403 forbidden error while creating service credential.
Reproduction
from databricks.sdk import WorkspaceClient
from databricks.sdk.service.catalog import (
AzureManagedIdentity,
CredentialPurpose,
)
w = WorkspaceClient(
host="host_name",
azure_client_id="client_id",
azure_client_secret="secret",
azure_tenant_id="tenant_id",
auth_type="azure-client-secret",
)
CREDENTIAL_NAME = "test_eventhub_reader_service_credential"
ACCESS_CONNECTOR_ID = (
connector_name
)
DESCRIPTION = (
"Test service credential for Event Hub reader "
"(mirrors eventhub_reader_service_credential) - "
"uses Access Connector with Managed Identity"
)
Step 1: Create the service credential using Managed Identity (REST API only - no SQL DDL exists)
credential = w.credentials.create_credential(
name=CREDENTIAL_NAME,
purpose=CredentialPurpose.SERVICE,
azure_managed_identity=AzureManagedIdentity(
access_connector_id=ACCESS_CONNECTOR_ID
),
comment=DESCRIPTION,
)
print(f"Service credential '{CREDENTIAL_NAME}' created successfully.")
Expected behavior
A new service credential should be created.
Is it a regression?
Did this work in a previous version of the SDK? If so, which versions did you try?- Not sure
Debug Logs
The SDK logs helpful debugging information when debug logging is enabled. Set the log level to Trace by configuring the default logger to log at trace (for example: add logger.DefaultLogger = &logger.SimpleLogger{Level: logger.LevelTrace} to your program), and include the logs here.
PermissionDenied: unable to parse response. This is likely a bug in the Databricks SDK for Python or the underlying API. Please report this issue with the following debugging information to the SDK issue tracker at https://github.com/databricks/databricks-sdk-go/issues. Request log:```POST /api/2.1/unity-catalog/credentials
- User-Agent: unknown/0.0.0 databricks-sdk-py/0.67.0 python/3.12.3 os/linux auth/azure-client-secret runtime/client.5.9
- Accept-Encoding: gzip, deflate, zstd
- Accept: application/json
- Connection: keep-alive
- Content-Type: application/json
- Content-Length: 430
403 Forbidden
< User not authorized.```
[Trace ID: 00-36b36226876c49dfaa306e296a440f51-8643fde504b63c63-00]
Other Information
- OS: [e.g. macOS]
- Version: [e.g. 0.1.0]
Additional context
Add any other context about the problem here.
Description
The service principal access acoount admin access and also have a contribuor role on access connector but still encountering permission 403 forbidden error while creating service credential.
Reproduction
from databricks.sdk import WorkspaceClient
from databricks.sdk.service.catalog import (
AzureManagedIdentity,
CredentialPurpose,
)
w = WorkspaceClient(
host="host_name",
azure_client_id="client_id",
azure_client_secret="secret",
azure_tenant_id="tenant_id",
auth_type="azure-client-secret",
)
CREDENTIAL_NAME = "test_eventhub_reader_service_credential"
ACCESS_CONNECTOR_ID = (
connector_name
)
DESCRIPTION = (
"Test service credential for Event Hub reader "
"(mirrors eventhub_reader_service_credential) - "
"uses Access Connector with Managed Identity"
)
Step 1: Create the service credential using Managed Identity (REST API only - no SQL DDL exists)
credential = w.credentials.create_credential(
name=CREDENTIAL_NAME,
purpose=CredentialPurpose.SERVICE,
azure_managed_identity=AzureManagedIdentity(
access_connector_id=ACCESS_CONNECTOR_ID
),
comment=DESCRIPTION,
)
print(f"Service credential '{CREDENTIAL_NAME}' created successfully.")
Expected behavior
A new service credential should be created.
Is it a regression?
Did this work in a previous version of the SDK? If so, which versions did you try?- Not sure
Debug Logs
The SDK logs helpful debugging information when debug logging is enabled. Set the log level to Trace by configuring the default logger to log at trace (for example: add
logger.DefaultLogger = &logger.SimpleLogger{Level: logger.LevelTrace}to your program), and include the logs here.PermissionDenied: unable to parse response. This is likely a bug in the Databricks SDK for Python or the underlying API. Please report this issue with the following debugging information to the SDK issue tracker at https://github.com/databricks/databricks-sdk-go/issues. Request log:```POST /api/2.1/unity-catalog/credentials
403 Forbidden
< User not authorized.```
[Trace ID: 00-36b36226876c49dfaa306e296a440f51-8643fde504b63c63-00]
Other Information
Additional context
Add any other context about the problem here.