From 315020018135eff670964f8998c4607ec678d370 Mon Sep 17 00:00:00 2001 From: simonfaltum Date: Tue, 9 Jun 2026 22:14:40 +0200 Subject: [PATCH 1/2] Skip workspace selection in auth login on account console hosts Classic account console hosts (accounts.*) serve only account-level APIs, so prompting for (or auto-selecting) a workspace during login stores a workspace_id that cannot be used against that host. shouldPromptWorkspace now returns false for these hosts, using the same canonical-host check as needsAccountIDPrompt and ToOAuthArgument. Explicit --workspace-id and host query params keep working unchanged. Co-authored-by: Isaac --- cmd/auth/login.go | 19 +++++++++++++------ cmd/auth/login_test.go | 25 +++++++++++++++++++++++++ 2 files changed, 38 insertions(+), 6 deletions(-) diff --git a/cmd/auth/login.go b/cmd/auth/login.go index f97acf84fe6..f9f2531ac74 100644 --- a/cmd/auth/login.go +++ b/cmd/auth/login.go @@ -410,16 +410,23 @@ a new profile is created. // shouldPromptWorkspace reports whether the login flow should ask the user to // pick a workspace. We prompt when we have an account_id but no workspace_id -// and the user did not pass --skip-workspace, with one exception: re-login -// into an existing profile that's already account-only for the SAME account -// (account_id matches and workspace_id is absent or the legacy "none" -// sentinel) honors the user's prior "skip" choice instead of re-prompting on -// every login. We require the account_id to match so reusing a profile name -// against a different account still gets the workspace prompt. +// and the user did not pass --skip-workspace, with two exceptions: +// - Classic account console hosts (accounts.*) serve only account-level +// APIs, so a selected workspace_id would be unusable against that host +// and only misleads later commands. +// - Re-login into an existing profile that's already account-only for the +// SAME account (account_id matches and workspace_id is absent or the +// legacy "none" sentinel) honors the user's prior "skip" choice instead +// of re-prompting on every login. We require the account_id to match so +// reusing a profile name against a different account still gets the +// workspace prompt. func shouldPromptWorkspace(authArguments *auth.AuthArguments, existingProfile *profile.Profile, skipWorkspace bool) bool { if authArguments.AccountID == "" || authArguments.WorkspaceID != "" || skipWorkspace { return false } + if auth.IsClassicAccountHost((&config.Config{Host: authArguments.Host}).CanonicalHostName()) { + return false + } if existingProfile != nil && existingProfile.AccountID == authArguments.AccountID && (existingProfile.WorkspaceID == "" || existingProfile.WorkspaceID == auth.WorkspaceIDNone) { diff --git a/cmd/auth/login_test.go b/cmd/auth/login_test.go index fdeef6a4c75..a8eafb4be43 100644 --- a/cmd/auth/login_test.go +++ b/cmd/auth/login_test.go @@ -566,6 +566,31 @@ func TestShouldPromptWorkspace(t *testing.T) { authArguments: auth.AuthArguments{AccountID: "acc"}, want: true, }, + { + name: "classic account console host never prompts", + authArguments: auth.AuthArguments{Host: "https://accounts.test", AccountID: "acc"}, + want: false, + }, + { + name: "classic account console host without scheme never prompts", + authArguments: auth.AuthArguments{Host: "accounts.test", AccountID: "acc"}, + want: false, + }, + { + name: "accounts-dod host never prompts", + authArguments: auth.AuthArguments{Host: "https://accounts-dod.test", AccountID: "acc"}, + want: false, + }, + { + name: "workspace host with account_id prompts", + authArguments: auth.AuthArguments{Host: "https://myworkspace.test", AccountID: "acc"}, + want: true, + }, + { + name: "classic account console host with workspace_id set never prompts", + authArguments: auth.AuthArguments{Host: "https://accounts.test", AccountID: "acc", WorkspaceID: "12345"}, + want: false, + }, { name: "re-login into legacy account-only profile (workspace_id = none)", authArguments: auth.AuthArguments{AccountID: "spog-account"}, From e6710e24ddc5ef5b9436287daa985f6f73f6ff25 Mon Sep 17 00:00:00 2001 From: simonfaltum Date: Tue, 9 Jun 2026 22:18:31 +0200 Subject: [PATCH 2/2] Add changelog entry Co-authored-by: Isaac --- NEXT_CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/NEXT_CHANGELOG.md b/NEXT_CHANGELOG.md index db25ff3c12a..078c98e6bf1 100644 --- a/NEXT_CHANGELOG.md +++ b/NEXT_CHANGELOG.md @@ -7,6 +7,7 @@ ### CLI * Added the `databricks quickstart` command, a short introduction to the CLI that prints a human-friendly guide interactively and an agent-oriented version when run non-interactively ([#5464](https://github.com/databricks/cli/pull/5464)). +* `databricks auth login` no longer prompts for workspace selection when logging in to an account console host (`https://accounts.*`). Pass `--workspace-id` explicitly to store a workspace ID on such a profile ([#5504](https://github.com/databricks/cli/pull/5504)). ### Bundles * Set the default `data_security_mode` to `DATA_SECURITY_MODE_AUTO` in bundle templates ([#5452](https://github.com/databricks/cli/pull/5452)).