[ML-62918] Auto-detect OBO endpoints and forward user token#145
Open
[ML-62918] Auto-detect OBO endpoints and forward user token#145
Conversation
When the serving endpoint has auth_policy.user_auth_policy.api_scopes (OBO-enabled), the chat template now: 1. Detects OBO via the serving-endpoints API response 2. Logs a warning with required scopes for the user to configure 3. Exposes OBO status via GET /api/config 4. Forwards x-forwarded-access-token header to the endpoint Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
When the serving endpoint has OBO scopes (auth_policy.user_auth_policy), display an amber badge in the chat header listing the required scopes and linking to the auth docs. Also notes that UC function scopes are not yet supported. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
dhruv0811
force-pushed
the
obo-auto-detection
branch
from
eb21e57 to
0e82c5b
Compare
- Always include serving.serving-endpoints in required OBO scopes - Detect Supervisor Agents via tile_endpoint_metadata.problem_type - Decode user JWT server-side to check which scopes are present - Only show banner for MISSING scopes (disappears when all configured) - Parent scope matching (e.g. "sql" satisfies "sql.statement-execution") - Full-width red banner with error icon and doc link - Use user's OBO token as Authorization when endpoint supports OBO - Remove debug logging Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
dhruv0811
changed the title
bbqiu
reviewed
Mar 12, 2026
| 'https://docs.databricks.com/aws/en/generative-ai/agent-framework/chat-app'; | ||
|
|
||
| const OBO_DOCS_URL = | ||
| 'https://docs.databricks.com/aws/en/dev-tools/databricks-apps/auth'; |
Contributor
There was a problem hiding this comment.
let's update this to the new page you made in https://github.com/databricks-eng/universe/pull/1687597
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Auto-detect OBO-enabled serving endpoints and surface scope configuration to the user.
This is a followup to #152 which only addressed the Agents on Apps token forwarding. In this PR, we also address apps connected directly to a model serving endpoint.
Detection:
auth_policy.user_auth_policy.api_scopes(custom endpoints) ortile_endpoint_metadata.problem_type === "MULTI_AGENT_SUPERVISOR"(Supervisor Agents)serving.serving-endpointsin required scopes (needed to call the endpoint as the user)Token forwarding:
Authorizationheader with the user'sx-forwarded-access-tokenso the endpoint sees the user's identityx-forwarded-access-tokenthroughstreamTextheaders in the chat routeSmart banner:
sqlsatisfiessql.statement-executionandsql.warehousesGET /api/config→obo.missingScopesNote: UC function scopes are not yet supported in the Apps scope configuration UI.
No scopes enabled on app connected to serving endpoint that requires scopes:
Logs:
After adding partially required scopes (error message updates after checking whats on the token):
After adding ALL required scopes:
Still works for OBO on Agents on Apps:
