CXH-2166: revert PAT auth and workspace filtering (revert #54)

README.md

@@ -17,26 +17,18 @@ of an account, after you log into account platform and click on your username in
 right top corner that will open a dropdown menu with the account ID along other
 options.
 
-Another requirement is to have valid credentials to run the connector with. This
-will decide how connector will be executed. You can use either the OAuth client
-credentials flow or the Bearer auth flow. OAuth can be used across account and
-all workspaces you have access to. Bearer auth can be used only for a specific
-workspace.
-
-To use the OAuth, you need to create a service principal and add OAuth secret
-(client id and secret) to it. You can do that by going to the user management
-tab and clicking on the Service Principals tab. Then click on the Add Service
-principal button and name it. You then need to add OAuth secret to it by
-clicking on the Generate secret button. You can use this secret to authenticate
-across all workspaces that service principal has access to. This requires admin
-access to the Databricks account and each workspace you want to sync.
-
-To use bearer auth, you need to provide a Databricks workspace access token. You
-can create a new token by logging into the workspace and going into user
-settings. Then go to Developer tab and create a new access token. This will try
-to work with only specified workspaces and their respective tokens. You can
-provide multiple tokens by separating them with a comma. This method requires
-admin access to each workspace you want to sync.
+Another requirement is to have valid credentials to run the connector with. The
+connector authenticates with the OAuth client credentials flow, using an
+account-level service principal that works across the account and every
+workspace it has access to.
+
+To set this up, create a service principal and add an OAuth secret (client ID
+and secret) to it. You can do that by going to the user management tab and
+clicking on the Service Principals tab. Then click on the Add Service principal
+button and name it. You then need to add an OAuth secret to it by clicking on
+the Generate secret button. You can use this secret to authenticate across all
+workspaces that service principal has access to. This requires admin access to
+the Databricks account and each workspace you want to sync.
 
 # Using Azure Databricks
 
@@ -85,42 +77,30 @@ baton resources
 - Users
 - Roles
 
-By default (OAuth), the connector fetches all resources from the account and all
-workspaces. To limit the scope, pass a comma-separated list of workspace
-deployment names to the `--workspaces` flag.
+The connector fetches all resources from the account and every workspace the
+service principal can access. There is no workspace allowlist; to narrow the
+scope, exclude workspaces as described below.
 
 ## Authentication
 
-OAuth is the only authentication method currently available: an account-level
-service principal's client ID and secret.
-
-> **Workspace-token (PAT) authentication is temporarily unavailable.**
-> `--auth-method workspace-token` is not offered, and a config specifying it is
-> rejected at startup with a clear error. `--workspace-tokens` still appears in
-> `--help` but no authentication method consumes it. `--workspaces` remains
-> supported under OAuth for limiting the sync scope, as described above.
->
-> The implementation is intact and commented out in `pkg/config/config.go`
-> rather than deleted; it is withheld while a platform-side defect is resolved.
-> The defect is not in this connector — a credential declared as a list of
-> secrets is not treated as secret by the configuration layer, so a workspace
-> token supplied through the UI is stored unencrypted and shown in clear text.
+OAuth is the only authentication method: an account-level service principal's
+client ID and secret, supplied through `--databricks-client-id` and
+`--databricks-client-secret`. There is no personal access token (PAT) or
+workspace-token option, and no username/password option.
 
 OAuth requires a reachable account API. If the account API check fails at
-startup, the connector fails validation instead of falling back to a
-workspace-only sync, even when `--workspaces` is set.
+startup, the connector fails validation rather than falling back to a
+workspace-only sync.
 
-To instead exclude specific workspaces from the sync, pass them to the
+To exclude specific workspaces from the sync, pass them to the
 `--databricks-exclude-workspaces` flag (or the
 `BATON_DATABRICKS_EXCLUDE_WORKSPACES` environment variable) as a comma-separated
 list. Each entry can be a workspace name, deployment name, or numeric workspace
 ID. Excluded workspaces and their roles are skipped entirely.
 
 ## Group provisioning
 
-Account groups are provisioned through the OAuth client ID and secret flow. The
-Databricks API does not allow provisioning account groups from a workspace
-token, which is one reason the OAuth flow is the supported path.
+Account groups are provisioned through the OAuth client ID and secret flow.
 [Here](https://docs.databricks.com/aws/en/admin/users-groups/groups#:~:text=Types%20of%20groups%20in%20Databricks,permissions%20to%20identity%20federated%20workspaces.)
 are the different types of groups in Databricks.
 
@@ -177,15 +157,13 @@ Flags:
   -p, --provisioning                                     This must be set in order for provisioning actions to be enabled ($BATON_PROVISIONING)
       --skip-entitlements-and-grants                     This must be set to skip syncing of entitlements and grants ($BATON_SKIP_ENTITLEMENTS_AND_GRANTS)
       --skip-full-sync                                   This must be set to skip a full sync ($BATON_SKIP_FULL_SYNC)
-      --storage-engine string                            The storage engine to use when opening the sync c1z file: sqlite or pebble. Leave unset to use the baton-sdk default. ($BATON_STORAGE_ENGINE)
+      --storage-engine string                            The storage engine to use when opening the sync c1z file: sqlite or pebble. Defaults to pebble when unset. ($BATON_STORAGE_ENGINE)
       --sync-resource-types strings                      The resource type IDs to sync ($BATON_SYNC_RESOURCE_TYPES)
       --sync-resources strings                           The resource IDs to sync ($BATON_SYNC_RESOURCES)
       --task-concurrency int                             The number of Baton tasks to run concurrently in service mode. Tasks may include sync, grant, revoke, and more. Minimum value is 1, maximum value is 100. ($BATON_TASK_CONCURRENCY) (default 3)
       --ticketing                                        This must be set to enable ticketing support ($BATON_TICKETING)
   -v, --version                                          version for baton-databricks
       --workers int                                      The number of sync workers to use. -1 for auto-detect, 0 for sequential, >0 for parallel ($BATON_WORKERS)
-      --workspace-tokens strings                         required: The Databricks personal access tokens scoped to specific workspaces used to connect to the Databricks Workspace API ($BATON_WORKSPACE_TOKENS)
-      --workspaces strings                               Limit syncing to the specified workspaces, by deployment name, not workspace ID. Required when using workspace tokens, in the same order as workspace-tokens. ($BATON_WORKSPACES)
 
 Use "baton-databricks [command] --help" for more information about a command.
 ```

config_schema.json

@@ -140,67 +140,14 @@
         "defaultValue": "cloud.databricks.com"
       }
     },
-    {
-      "name": "workspaces",
-      "displayName": "Workspaces",
-      "description": "Limit syncing to the specified workspaces, by deployment name, not workspace ID. Required when using workspace tokens, in the same order as workspace-tokens. Mutually exclusive with databricks-exclude-workspaces.",
-      "stringSliceField": {}
-    },
-    {
-      "name": "workspace-tokens",
-      "displayName": "Workspace Tokens",
-      "description": "The Databricks personal access tokens scoped to specific workspaces used to connect to the Databricks Workspace API",
-      "isRequired": true,
-      "isSecret": true,
-      "stringSliceField": {
-        "rules": {
-          "isRequired": true
-        }
-      }
-    },
     {
       "name": "databricks-exclude-workspaces",
       "displayName": "Exclude Workspaces",
-      "description": "Workspaces to exclude from sync, identified by workspace name, deployment name, or numeric workspace ID. Mutually exclusive with workspaces.",
+      "description": "Workspaces to exclude from sync, identified by workspace name, deployment name, or numeric workspace ID",
       "stringSliceField": {}
     }
   ],
-  "constraints": [
-    {
-      "kind": "CONSTRAINT_KIND_MUTUALLY_EXCLUSIVE",
-      "fieldNames": [
-        "workspaces",
-        "databricks-exclude-workspaces"
-      ]
-    },
-    {
-      "kind": "CONSTRAINT_KIND_DEPENDENT_ON",
-      "fieldNames": [
-        "workspace-tokens"
-      ],
-      "secondaryFieldNames": [
-        "workspaces"
-      ]
-    }
-  ],
   "displayName": "Databricks",
   "helpUrl": "/docs/baton/databricks",
-  "iconUrl": "/static/app-icons/databricks.svg",
-  "fieldGroups": [
-    {
-      "name": "oauth2",
-      "displayName": "OAuth2",
-      "helpText": "Authenticate as a service principal using an OAuth2 client ID and secret.",
-      "fields": [
-        "account-id",
-        "databricks-client-id",
-        "databricks-client-secret",
-        "hostname",
-        "account-hostname",
-        "workspaces",
-        "databricks-exclude-workspaces"
-      ],
-      "default": true
-    }
-  ]
+  "iconUrl": "/static/app-icons/databricks.svg"
 }

docs/connector.mdx

@@ -23,13 +23,7 @@ The Databricks connector supports [automatic account provisioning and deprovisio
 
 ## Authentication methods
 
-The connector authenticates with **OAuth** — an account-level service principal's client ID and secret. This is the only method currently offered.
-
-<Warning>
-**Workspace-token (personal access token) authentication is temporarily unavailable.** It is not offered when configuring the connector, and configurations that specify it are rejected at startup. Use OAuth instead.
-
-The connector's PAT implementation is intact and the method is expected to return; it is withheld while a platform-side defect is resolved. The defect is not in this connector: a credential declared as a list of secrets is not treated as secret by the configuration layer, so a workspace token supplied through the UI would be stored unencrypted and displayed in clear text.
-</Warning>
+The connector authenticates with **OAuth** — an account-level service principal's client ID and secret. This is the only authentication method the connector supports.
 
 ## Gather Databricks credentials
 
@@ -55,29 +49,23 @@ A user with the **Account admin** role in each Databricks workspace you want to
 
 ### Generate Databricks credentials
 
-The Databricks connector authenticates with OAuth:
-
-- **OAuth** (syncs info from all Databricks workspaces)
+The Databricks connector authenticates with OAuth, which syncs info from all Databricks workspaces the service principal can access.
 
-  <Steps>
-    <Step>
-    Follow the [Databricks OAuth authentication documentation](https://docs.databricks.com/en/dev-tools/auth/oauth-m2m.html) to create a service principal and create an OAuth secret.
-    </Step>
-    <Step>
-    Carefully copy and save the OAuth client ID and secret.
-    </Step>
-  </Steps>
+<Steps>
+  <Step>
+  Follow the [Databricks OAuth authentication documentation](https://docs.databricks.com/en/dev-tools/auth/oauth-m2m.html) to create a service principal and create an OAuth secret.
+  </Step>
+  <Step>
+  Carefully copy and save the OAuth client ID and secret.
+  </Step>
+</Steps>
 
 **Done.** Here's the set of credentials you'll need when setting up the connector:
 
 - Account ID
 - OAuth client ID
 - OAuth client secret
 
-<Note>
-Personal access token (workspace token) authentication is **temporarily unavailable** and is not offered when configuring the connector, so there is no need to generate one. See [Authentication methods](#authentication-methods) above.
-</Note>
-
 Next, move on to the instructions for your chosen setup method.
 
 ## Configure the Databricks connector
@@ -210,25 +198,16 @@ stringData:
   BATON_DATABRICKS_CLIENT_ID: <OAuth client ID>
   BATON_DATABRICKS_CLIENT_SECRET: <OAuth client secret>
 
-  # Optional: limit the sync to specific workspaces, by deployment name.
-  # Mutually exclusive with BATON_DATABRICKS_EXCLUDE_WORKSPACES — set one or the other, never both.
-  # BATON_WORKSPACES: <deployment name of workspace-a,deployment name of workspace-b>
-
   # Optional: exclude specific workspaces from the sync
   # (workspace name, deployment name, or numeric ID).
-  # Mutually exclusive with BATON_WORKSPACES — set one or the other, never both.
   BATON_DATABRICKS_EXCLUDE_WORKSPACES: <workspace-a,workspace-b>
 
   # Optional: include if you want C1 to provision access using this connector
   BATON_PROVISIONING: true
 ```
 
-<Warning>
-**`BATON_WORKSPACES` and `BATON_DATABRICKS_EXCLUDE_WORKSPACES` cannot both be set.** They are mutually exclusive, and a config carrying both is rejected at startup before any API call. Choose one.
-</Warning>
-
 <Note>
-OAuth requires a reachable account API. If the account API check fails at startup, the connector fails validation instead of falling back to a workspace-only sync, even when `BATON_WORKSPACES` is set.
+OAuth requires a reachable account API. If the account API check fails at startup, the connector fails validation instead of falling back to a workspace-only sync.
 </Note>
 
 See the connector's README or run `--help` to see all available configuration flags and environment variables.

docs/docs-info.md

@@ -12,17 +12,14 @@ While developing the connector, please fill out this form. This information is n
    >
    > - **User accounts**: create and delete account users.
    > - **Entitlements**: grant and revoke role and membership assignments on accounts, workspaces, groups, service principals, and roles.
-   >
-   > Provisioning of account groups is only available with OAuth. A workspace token cannot provision groups, because the Databricks API does not allow it from a workspace token.
 
 ## Connector credentials
 
 1. What credentials or information are needed to set up the connector? (For example, API key, client ID and secret, domain, etc.)
 
-   > The connector requires a Databricks account ID plus one of two authentication methods:
+   > The connector requires a Databricks account ID and OAuth credentials:
    >
-   > - **OAuth (recommended)**: a service principal OAuth client ID and client secret. Syncs the account and every workspace the service principal can access.
-   > - **Workspace token (PAT)**: one or more workspace personal access tokens paired positionally with the deployment names of the workspaces they authenticate. Scoped to the listed workspaces only.
+   > - **OAuth**: a service principal OAuth client ID and client secret. Syncs the account and every workspace the service principal can access. This is the connector's only authentication method.
    >
    > Google Cloud Platform and Azure Databricks customers also provide the account hostname and hostname.
 
@@ -32,17 +29,16 @@ While developing the connector, please fill out this form. This information is n
 
      > - **Account ID**: in the Databricks account console, open the menu next to your username in the upper-right corner; the account ID is shown there.
      > - **OAuth client ID and secret**: follow the [Databricks OAuth (M2M) documentation](https://docs.databricks.com/en/dev-tools/auth/oauth-m2m.html) to create a service principal and generate an OAuth secret.
-     > - **Workspace token**: in the workspace, go to **Settings** > **Developer** > **Access tokens**, click **Manage**, then **Generate new token**.
      > - **Deployment name**: the subdomain in the workspace URL (not the numeric workspace ID).
 
    * Does the credential need any specific scopes or permissions? If so, list them here.
 
-     > The credential must have admin access to each resource it reads or writes: account-admin on the Databricks account (for account-level sync and provisioning) and workspace-admin on each workspace being synced. Workspace-token auth only reaches the workspaces its tokens are scoped to.
+     > The credential must have admin access to each resource it reads or writes: account-admin on the Databricks account (for account-level sync and provisioning) and workspace-admin on each workspace being synced.
 
    * If applicable: Is the list of scopes or permissions different to sync (read) versus provision (read-write)? If so, list the difference here.
 
-     > No separate scopes: Databricks admin access covers both read (sync) and read-write (provision). The practical difference is coverage by auth method: OAuth reaches the account plane and all accessible workspaces; a workspace token reaches only its scoped workspaces and cannot read or write account-level entitlements, grants, or groups.
+     > No separate scopes: Databricks admin access covers both read (sync) and read-write (provision).
 
    * What level of access or permissions does the user need in order to create the credentials? (For example, must be a super administrator, must have access to the admin console, etc.)
 
-     > Account admin access to the Databricks account console (to create the service principal and OAuth secret), and workspace admin on each workspace (to mint workspace tokens).
+     > Account admin access to the Databricks account console (to create the service principal and OAuth secret), and workspace admin on each workspace being synced.