DX-118868: Add browser-based OAuth login flow#16
Draft
aniket-s-kulkarni wants to merge 8 commits intodremio:mainfrom
Draft
DX-118868: Add browser-based OAuth login flow#16aniket-s-kulkarni wants to merge 8 commits intodremio:mainfrom
aniket-s-kulkarni wants to merge 8 commits intodremio:mainfrom
Conversation
Add OAuth Authorization Code + PKCE flow as an alternative to PAT authentication. Users can now run `dremio login` to authenticate via browser, with tokens stored in ~/.config/dremioai/oauth_tokens.yaml. - OAuth discovery via .well-known/oauth-authorization-server - Dynamic Client Registration (DCR) with PKCE - Localhost callback server for auth code capture - Automatic token refresh on 401 (one retry per request) - Headless fallback: prints URL when browser unavailable - `dremio login` / `dremio logout` commands - Setup wizard offers OAuth alongside PAT Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Allow targeting a custom Dremio URL (e.g. app.dev.dremio.site) instead of defaulting to app.dremio.cloud. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The .well-known/oauth-authorization-server endpoint lives on the login subdomain (login.X), not the app subdomain (app.X). Rewrite app.* to login.* when constructing the discovery URL. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…18868) - Send `client_name` (not `client_id`) in DCR body per RFC 7591 - Gracefully fall back to the well-known client_id when the server rejects DCR (400/403), as Dremio servers may not allow open registration Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Dremio's OAuth server supports `dremio.all offline_access`, not `openid offline_access`. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The Dremio OAuth server's allow-listed redirect path is case-sensitive: /Callback, not /callback. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
After OAuth login succeeds, fetch the project list and let the user pick from a numbered menu instead of typing a project ID manually. Auto-selects when only one project exists. Falls back to manual prompt if the project list fetch fails. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…X-118868) - Only show ACTIVE and HIBERNATED projects (skip DELETED etc.) - Display project name, description, state, and creation date - Richer formatting in the project selection panel Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
dremio login/dremio logoutcommands for browser-based authdremio setup) offers OAuth alongside PAT~/.config/dremioai/oauth_tokens.yaml(mode 600)Jira: DX-118868
Files Changed (13 files, +1276/-57)
New
src/drs/oauth.py— OAuth flow engine (discovery, DCR, PKCE, callback server, token exchange, refresh)src/drs/token_store.py— Token persistence keyed by Dremio URLsrc/drs/commands/login.py— Login/logout commandsModified
src/drs/auth.py— PAT optional,auth_methodfield, token store fallbacksrc/drs/client.py— 401 intercept + per-request refreshsrc/drs/cli.py— Register login/logout, updated error messagesrc/drs/commands/setup.py— Auth method prompt (OAuth/PAT)Test plan
return Falsepaths)Reviewer notes
reflection.py(pre-existing, not part of this PR) flagged by reviewer — tracked separately🤖 Generated with Claude Code