Add auth logout command with --profile and --force flags#4613
Draft
mihaimitrea-db wants to merge 14 commits intomainfrom
Draft
Add auth logout command with --profile and --force flags#4613mihaimitrea-db wants to merge 14 commits intomainfrom
mihaimitrea-db wants to merge 14 commits intomainfrom
Conversation
mihaimitrea-db
requested review from
andrewnester,
anton-107,
denik,
pietern and
shreyas-goenka
as code owners
mihaimitrea-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
Collaborator
|
Commit: 86e0a5c
26 interesting tests: 9 FAIL, 7 KNOWN, 7 SKIP, 2 flaky, 1 BUG
Top 31 slowest tests (at least 2 minutes):
|
mihaimitrea-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
mihaimitrea-db
force-pushed
the
mihaimitrea-db/stack/auth_logout
branch
from
0b2d46f to
5f039b9
Compare
mihaimitrea-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
mihaimitrea-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
mihaimitrea-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
mihaimitrea-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
mihaimitrea-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
simonfaltum
approved these changes
Mar 2, 2026
Member
simonfaltum
left a comment
simonfaltum
left a comment
There was a problem hiding this comment.
Looks good! Maybe add an extra test but can also be done in a follow up at a later stage
pietern
reviewed
Mar 3, 2026
Contributor
pietern
left a comment
pietern
left a comment
There was a problem hiding this comment.
I recommend adding a few acceptance tests to test this e2e.
That would also capture some of the error messages.
| defaultConfigPath := "~/.databrickscfg" | ||
| if runtime.GOOS == "windows" { | ||
| defaultConfigPath = "%USERPROFILE%\\.databrickscfg" | ||
| } |
Contributor
There was a problem hiding this comment.
This looks like it belongs (or should already exist) in libs/databrickscfg.
Contributor
There was a problem hiding this comment.
This should also honor $DATABRICKS_CONFIG_FILE.
|
|
||
| tokenCache, err := cache.NewFileTokenCache() | ||
| if err != nil { | ||
| log.Warnf(ctx, "Failed to open token cache: %v", err) |
Collaborator
Author
There was a problem hiding this comment.
When the file is corrupted
Contributor
There was a problem hiding this comment.
Is the warning actionable for users?
Contributor
|
An acceptance test will also confirm the before/after state of the I would like to see if comments, ordering, etc, are retained upon profile deletion. |
mihaimitrea-db
force-pushed
the
mihaimitrea-db/stack/auth_logout
branch
from
b8fed18 to
0ca6e59
Compare
mihaimitrea-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
mihaimitrea-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
mihaimitrea-db
force-pushed
the
mihaimitrea-db/stack/auth_logout
branch
from
9cf58d8 to
66871b3
Compare
mihaimitrea-db
force-pushed
the
mihaimitrea-db/stack/auth_logout
branch
from
66871b3 to
1764259
Compare
mihaimitrea-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
Implement the initial version of databricks auth logout which removes a profile from ~/.databrickscfg and clears associated OAuth tokens from the token cache. This iteration supports explicit profile selection via --profile and a --force flag to skip the confirmation prompt. Interactive profile selection will be added in a follow-up. Token cache cleanup is best-effort: the profile-keyed token is always removed, and the host-keyed token is removed only when no other profile references the same host.
Replace plain fmt.Sprintf confirmation prompt with a structured template using cmdio.RenderWithTemplate. The warning now uses color and bold formatting to clearly highlight the profile name, config path, and consequences before prompting for confirmation.
Resolve config path from the profiler instead of hardcoding fallbacks. Delete the profile before clearing the token cache so a config write failure does not leave tokens removed. Fix token cleanup for account and unified profiles by computing the correct OIDC cache key (host/oidc/accounts/<account_id>). Drop the nil profiler guard, add a success message on logout, and extract backupConfigFile in ops.go to remove duplication. Consolidate token cleanup tests into a table-driven test covering shared hosts, unique hosts, account, and unified profiles.
Merge shared-host token deletion verification into one main parametrized test by addding the hostBasedKey and isSharedKey parameters to each case. This replaces the TestLogoutTokenCacheCleanup test with an assertion: host-based keys are preserved when another profile shares the same host, and deleted otherwise.
Rewrite the test to use inline config seeds and explicit expected state. Add cases for deleting the last non-default profile, deleting a unified host profile with multiple keys, and deleting the DEFAULT section.
- Use profiler.GetPath() to resolve config path instead of hardcoding platform-specific defaults for the help text. - Read DATABRICKS_CONFIG_FILE via env.Get(ctx, ...) instead of os.Getenv to respect context-level env overrides. - Add abort message when user declines the confirmation prompt. - Guard DeleteProfile against non-existent profiles to avoid creating unnecessary backup files. - Add TestDeleteProfile_NotFound for the error path.
Cover four scenarios: profile ordering and comments are preserved after deletion, deleting the last non-default profile leaves an empty DEFAULT section, deleting the DEFAULT profile itself clears its keys and restores the default comment, and error paths for non-existent profiles and missing --profile in non-interactive mode.
By default, Authentication related commands. For more information regarding how authentication for the Databricks CLI and SDKs work please refer to the documentation linked below. AWS: https://docs.databricks.com/dev-tools/auth/index.html Azure: https://learn.microsoft.com/azure/databricks/dev-tools/auth GCP: https://docs.gcp.databricks.com/dev-tools/auth/index.html Usage: databricks auth [command] Available Commands: describe Describes the credentials and the source of those credentials, being used by the CLI to authenticate env Get env login Log into a Databricks workspace or account profiles Lists profiles from ~/.databrickscfg token Get authentication token Flags: --account-id string Databricks Account ID --experimental-is-unified-host Flag to indicate if the host is a unified host -h, --help help for auth --host string Databricks Host --workspace-id string Databricks Workspace ID Global Flags: --debug enable debug logging -o, --output type output type: text or json (default text) -p, --profile string ~/.databrickscfg profile -t, --target string bundle target to use (if applicable) Use "databricks auth [command] --help" for more information about a command. now only clears cached OAuth tokens without removing the profile from ~/.databrickscfg. Pass --delete to also remove the profile entry from the config file.
mihaimitrea-db
force-pushed
the
mihaimitrea-db/stack/auth_logout
branch
from
1764259 to
e8a6f57
Compare
mihaimitrea-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
Existing acceptance tests that verify profile deletion now use --delete since profile removal is opt-in. Two new acceptance tests verify token-only logout: one for a unique host (both cache entries cleared) and one for a shared host (host-keyed token preserved).
mihaimitrea-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
Replace manual strings.TrimRight(host, /) with the SDK's config.Config.CanonicalHostName(), which handles scheme normalization, trailing slashes, and empty hosts consistently with how the SDK itself computes token cache keys.
mihaimitrea-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
mihaimitrea-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
pietern
reviewed
Mar 4, 2026
| token = dev-token | ||
| EOF | ||
|
|
||
| title "Logout of non-existent profile" |
Contributor
There was a problem hiding this comment.
Please use \n on title to break error to newline for both cases.
| @@ -0,0 +1,8 @@ | |||
|
|
|||
| === Logout of non-existent profileError: profile "nonexistent" not found. Available profiles: [dev] | |||
| token = dev-token | ||
|
|
||
| ; The profile defined in the DEFAULT section is to be used as a fallback when no profile is explicitly specified. | ||
| [DEFAULT] |
Contributor
There was a problem hiding this comment.
The comment says that it should remain at the top, but it was moved to the bottom.
|
|
||
| === Logout dev without --delete | ||
| >>> [CLI] auth logout --profile dev --force | ||
| Successfully logged out of profile "dev". To remove the profile from the config file, use --delete. |
Contributor
There was a problem hiding this comment.
The dev profile is not a u2m profile. If nothing changed, why do we say logout was successful?
Collaborator
Author
There was a problem hiding this comment.
Should this cmd not be able to logout off M2M profiles?
The logout has been successful since there is no token with the key "dev" in the cache anymore. The profile should not be deleted because the --delete flag was not used right?
Contributor
There was a problem hiding this comment.
What does "logout" mean? I think removing the token from the cache.
The profile here is not an m2m profile but a PAT profile (with the token inlined).
IMO, we only operate on u2m profiles to be symmetric with login.
cc @simonfaltum
Member
There was a problem hiding this comment.
I'm not super clear on how M2M profiles work - if they don't store a token in the cache, then obviously we can't "log out" and we should display that correctly.
If we have the --delete flag it should still be possible to remove the profile after they confirm they want to ?
| // If the config path is not found, revert to the default path for the description as a fallback. | ||
| // During the execution of the command, if this is the case an error will be returned. | ||
| if err != nil { | ||
| log.Warnf(context.Background(), "Failed to get config path: %v, using default path ~/.databrickscfg", err) |
Contributor
There was a problem hiding this comment.
The logger is not properly initialized at this point.
Can you defer computing this until the command is executed?
Otherwise, can we make this static?
Contributor
There was a problem hiding this comment.
(I'm not sure why we need this at initialization time)
|
|
||
| tokenCache, err := cache.NewFileTokenCache() | ||
| if err != nil { | ||
| log.Warnf(ctx, "Failed to open token cache: %v", err) |
Contributor
There was a problem hiding this comment.
Is the warning actionable for users?
mihaimitrea-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🥞 Stacked PR
Use this link to review incremental changes.
Implement
databricks auth logoutwhich clears cached OAuth tokens for a profile and, optionally, removes the profile from ~/.databrickscfg.By default the command only clears tokens, requiring re-authentication on next use. Pass
--deleteto also remove the profile entry from the config file. This iteration supports explicit profile selection via--profileand a--forceflag to skip the confirmation prompt. Interactive profile selection will be added in a follow-up.Token cache cleanup is best-effort: the profile-keyed token is always removed, and the host-keyed token is removed only when no other profile references the same host.
Changes
databricks auth logoutcommand (cmd/auth/logout.go) registered under the auth command group.--profileselects the profile to log out of;--forceskips the confirmation prompt.--deleteopts in to removing the profile section from ~/.databrickscfg. Without it, only cached OAuth tokens are cleared.clearTokenCacheremoves the profile-keyed token and, if no other profile shares the same host, the host-keyed token. Host URLs are normalized (trailing slash stripped) to match token cache keys.DeleteProfileinlibs/databrickscfg/ops.goremoves a named section from ~/.databrickscfg, creating a .bak backup first.Why
There is currently no way to log out of a Databricks profile from the CLI. Users must manually edit ~/.databrickscfg and locate/delete token cache entries. This command provides a safe, single-step logout that handles token cleanup and optional profile removal.
Open issue from users requesting this feature: #1639
Tests
runLogoutcovering: successful logout, logout with--delete, non-interactive mode without--force, non-existent profile, shared-host token preservation, and logout with an empty token cache.DeleteProfilecovering: deleting an existing profile, profile not found, and custom config path.--profilein non-interactive mode.