Description

septponf

opened on Oct 30, 2025

Issue body actions

This was originally posted in dbt-databricks project and I was asked to cross post i here.

Related to: databricks/dbt-databricks#1246

When running dbt in an Azure Devops Agent (for continues integration reasons) I get this warning:

09:13:52  Concurrency: 6 threads (target='test')
09:13:52  
09:13:53  databricks-sql-connector adapter: Token exchange failed, using external token: %s
WARNING:databricks.sql.auth.token_federation:Token exchange failed, using external token: 'access_token'

It still works, the project runs, but I would like to understand what might be happening here.
I am not able to reproduce this on my local machine using the same M2M profile.
Maybe you can point me in the right direction?

Profile using an azure service principal:

    test:
      host: the_host
      http_path: the_path
      catalog: the_catalog
      schema: test
      threads: 6
      type: databricks
      auth_type: oauth
      azure_client_id: "{{ env_var('DATABRICKS_CLIENT_ID') }}"
      azure_client_secret: "{{ env_var('DATABRICKS_CLIENT_SECRET') }}"

Python 3.11.13
Running with dbt=1.10.8
Registered adapter: databricks=1.10.9

The Devops Azure Agent runs an ubuntu-24.04 Image
Version: 20250929.60.1

Reacted by Carlos Eduardo Moreira dos Santos and plgelinas

Activity

1. msrathore-db commented on Nov 3, 2025

   

   msrathore-db

   on Nov 3, 2025

   Contributor

   More actions

   The logs are regarding token exchange. Currently we try to exchange external Idp tokens for internal Databricks tokens and silently fail if it is not possible
2. MCESARI-VA commented on Nov 21, 2025

   

   MCESARI-VA

   on Nov 21, 2025

   More actions

   hello, is there any news on this "silently fail" ?
3. calbert82uhah commented on Dec 17, 2025

   

   calbert82uhah

   on Dec 17, 2025

   More actions

   I get the same error message when I run
   (...)

           return sql.connect(
               server_hostname = st.secrets["DATABRICKS_SERVER_HOST"],
               http_path = st.secrets["DATABRICKS_HTTP_PATH"],
               access_token = entra_token
           )
   

   entra_token is a valid Entra Id token.
   The connection works afterwards, but I do not understand why I get this warning on the console.
4. lorogno commented on Aug 7, 2026

   

   lorogno

   on Aug 7, 2026

   More actions

   Still relevant!
5. vuanhphung commented on Oct 30, 2026

   

   vuanhphung

   on Oct 30, 2026

   Collaborator

   More actions

   Closing as a duplicate of #904, which traces this warning to the token-exchange code raising KeyError('access_token') when the exchange endpoint returns an error, which is why the log line shows only 'access_token'. PR #928 addresses it there.
6. vuanhphung

   closed this as a duplicateof Token federation: _exchange_token raises KeyError('access_token') on error responses, discarding the real failure reason #904 on Oct 30, 2026

Issue actions