Add explicit Azure CLI authentication

packages/auth/NEXT_CHANGELOG.md

@@ -4,6 +4,10 @@
 
 ### New Features and Improvements
 
+- Added explicit Node.js Azure CLI authentication through
+  `newAzureCliCredentials`, with an optional tenant ID. Azure CLI authentication
+  is not part of the default credential chain.
+
 ### Bug Fixes
 
 ### Documentation

packages/auth/package.json

@@ -53,6 +53,7 @@
     "node": ">=22.0.0"
   },
   "dependencies": {
+    "@azure/identity": "^4.13.3",
     "@databricks/sdk-core": ">=0.51.0 <1.0.0",
     "zod": "^4.3.6"
   }

packages/auth/src/credentials/azure-cli.ts

@@ -0,0 +1,66 @@
+import {AzureCliCredential} from '@azure/identity';
+import {z} from 'zod';
+
+import type {Token, TokenCredentials} from '../auth';
+import {newTokenCredentials, tokenProviderFn} from '../auth';
+
+import {AzureCliCredentialsError} from './errors';
+
+const AZURE_DATABRICKS_SCOPE = '2ff814a6-3304-4ab8-85cb-cd0e6f879c1d/.default';
+
+/** Configures {@link newAzureCliCredentials}. */
+export interface AzureCliCredentialsOptions {
+  /** Selects a tenant by ID, defaulting to the Azure CLI's current tenant. */
+  tenantId?: string;
+}
+
+/**
+ * Creates Node.js credentials using an existing `az login` session.
+ * Azure CLI authentication is not included in the default credential chain.
+ */
+export function newAzureCliCredentials(
+  options?: AzureCliCredentialsOptions
+): TokenCredentials {
+  const credential = new AzureCliCredential(
+    options?.tenantId === undefined ? undefined : {tenantId: options.tenantId}
+  );
+  const provider = tokenProviderFn(() => fetchAzureCliToken(credential));
+  return newTokenCredentials('azure-cli', provider);
+}
+
+const tokenResponseSchema = z.object({
+  token: z.string().min(1),
+  expiresOnTimestamp: z
+    .number()
+    .transform(timestamp => new Date(timestamp))
+    .pipe(z.date()),
+});
+
+async function fetchAzureCliToken(
+  credential: AzureCliCredential
+): Promise<Token> {
+  let response: unknown;
+  try {
+    response = await credential.getToken(AZURE_DATABRICKS_SCOPE);
+  } catch (e: unknown) {
+    const message = e instanceof Error ? e.message : String(e);
+    throw new AzureCliCredentialsError(
+      'TOKEN_FETCH_FAILED',
+      `cannot get Azure CLI access token: ${message}`,
+      {cause: e}
+    );
+  }
+
+  const result = tokenResponseSchema.safeParse(response);
+  if (!result.success) {
+    throw new AzureCliCredentialsError(
+      'INVALID_RESPONSE',
+      `invalid Azure CLI token response: ${result.error.message}`
+    );
+  }
+  return {
+    value: result.data.token,
+    type: 'Bearer',
+    expiry: result.data.expiresOnTimestamp,
+  };
+}

packages/auth/src/credentials/errors.ts

@@ -67,3 +67,23 @@ export class U2mCredentialsError extends Error {
     this.code = code;
   }
 }
+
+/** Identifies why Azure CLI credentials failed. */
+export type AzureCliCredentialsErrorCode =
+  | 'TOKEN_FETCH_FAILED'
+  | 'INVALID_RESPONSE';
+
+/** Reports a failed Azure CLI token request or an unusable token response. */
+export class AzureCliCredentialsError extends Error {
+  readonly code: AzureCliCredentialsErrorCode;
+
+  constructor(
+    code: AzureCliCredentialsErrorCode,
+    message: string,
+    options?: ErrorOptions
+  ) {
+    super(message, options);
+    this.name = 'AzureCliCredentialsError';
+    this.code = code;
+  }
+}

packages/auth/src/credentials/index.ts

@@ -3,15 +3,19 @@
  */
 
 export {
+  AzureCliCredentialsError,
   M2mCredentialsError,
   PatCredentialsError,
   U2mCredentialsError,
 } from './errors';
 export type {
+  AzureCliCredentialsErrorCode,
   M2mCredentialsErrorCode,
   PatCredentialsErrorCode,
   U2mCredentialsErrorCode,
 } from './errors';
+export {newAzureCliCredentials} from './azure-cli';
+export type {AzureCliCredentialsOptions} from './azure-cli';
 export {newM2mCredentials} from './m2m';
 export type {M2mCredentialsOptions} from './m2m';
 export {newPatCredentials} from './pat';