Skip to content

Disable async token refresh for GCP credential providers #1575

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
renaudhartert-db merged 3 commits into from
Mar 22, 2026
Merged

Disable async token refresh for GCP credential providers #1575

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
080da6d
Disable async token refresh for GCP credential providers
renaudhartert-db Mar 21, 2026
a253151
Simplify comments for disabled async token refresh
renaudhartert-db Mar 22, 2026
d0c5a4b
Merge branch 'main' into disable-gcp-async-refresh
simonfaltum Mar 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions NEXT_CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,8 @@

### Bug Fixes

* Disable async token refresh for GCP credential providers to avoid wasted refresh attempts caused by double-caching with Google's internal `oauth2.ReuseTokenSource` ([#1549](https://github.com/databricks/databricks-sdk-go/issues/1549)).

### Documentation

### Internal Changes
Expand Down
10 changes: 9 additions & 1 deletion config/auth_gcp_google_credentials.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@ import (
"os"

"github.com/databricks/databricks-sdk-go/config/credentials"
"github.com/databricks/databricks-sdk-go/config/experimental/auth"
"github.com/databricks/databricks-sdk-go/logger"
"golang.org/x/oauth2/google"
"google.golang.org/api/idtoken"
Expand Down Expand Up @@ -41,8 +42,15 @@ func (c GoogleCredentials) Configure(ctx context.Context, cfg *Config) (credenti
if err != nil {
return nil, fmt.Errorf("could not obtain OAuth2 token from JSON: %w", err)
}
// Disable async token refresh. Google's token sources cache tokens
// internally via oauth2.ReuseTokenSource, and there is no way to
// bypass this caching for unexported token source types. Async
// refresh would be unnecessary work since Google's cache already
// handles token renewal.
opts := append(cacheOptions(cfg), auth.WithAsyncRefresh(false))

logger.Infof(ctx, "Using Google Credentials")
visitor := serviceToServiceVisitor(inner, creds.TokenSource, "X-Databricks-GCP-SA-Access-Token", true, cacheOptions(cfg)...)
visitor := serviceToServiceVisitor(inner, creds.TokenSource, "X-Databricks-GCP-SA-Access-Token", true, opts...)
return credentials.NewOAuthCredentialsProvider(visitor, inner.Token), nil
}

Expand Down
10 changes: 9 additions & 1 deletion config/auth_gcp_google_id.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@ import (
"fmt"

"github.com/databricks/databricks-sdk-go/config/credentials"
"github.com/databricks/databricks-sdk-go/config/experimental/auth"
"github.com/databricks/databricks-sdk-go/logger"
"golang.org/x/oauth2"
"google.golang.org/api/impersonate"
Expand All @@ -28,7 +29,14 @@ func (c GoogleDefaultCredentials) Configure(ctx context.Context, cfg *Config) (c
if err != nil {
return nil, err
}
opts := cacheOptions(cfg)

// Disable async token refresh. Google's token sources cache tokens
// internally via oauth2.ReuseTokenSource, and there is no way to
// bypass this caching for unexported token source types. Async
// refresh would be unnecessary work since Google's cache already
// handles token renewal.
opts := append(cacheOptions(cfg), auth.WithAsyncRefresh(false))

// Always attempt to create SA token source for the secondary header.
// If it fails, fall back to refreshableVisitor with a warning.
platform, err := impersonate.CredentialsTokenSource(ctx, impersonate.CredentialsConfig{
Expand Down
Loading