docs: correct the Connect OAuth issuer to bare origin - #5278
Open
QuiltSimon wants to merge 2 commits into
Open
Conversation
The OAuth Metadata section claimed Quilt emits an explicit :443 because Databricks Apps reject an issuer that omits the default port. No Databricks documentation states this, and #1056's own deployment verification reported a working Databricks stack against a bare-origin issuer 16 days before :443 was added. RFC 3986 3.2.3 says a URI producer should omit a default port, and no major provider emits one. Verified on dev: Databricks completed OAuth DCR against a bare-origin issuer. Also note the Databricks redirect host is regional (oregon.cloud.databricks.com), not the workspace host, so ConnectAllowedHosts needs the leading-dot suffix form; a bare workspace hostname is an exact-match entry and will not match it. Co-Authored-By: Claude Code <noreply@anthropic.com>
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #5278 +/- ##
=======================================
Coverage 34.92% 34.92%
=======================================
Files 741 741
Lines 23804 23804
Branches 6429 6429
=======================================
Hits 8314 8314
Misses 13746 13746
Partials 1744 1744
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
The intro named only Claude and Cursor while the Supported Clients list and the setup section already covered Codex. Co-Authored-By: Claude Code <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
The Connect OAuth docs claimed Quilt emits an explicit
:443in the issuer because Databricks Apps require it. That claim is unsupported, and the registry no longer does it.Code companion: quiltdata/enterprise#1142
No Databricks documentation mentions the issuer field or a port requirement. The claim traces to a single PR description (enterprise#1056), where
:443was appended after the commit that actually fixed Databricks — the one removing the/authpath component (RFC 8414 §3 forbids a path). Verified on dev: Databricks completes OAuth DCR against a bare-origin issuer, while the:443broke the Codex CLI, which normalizes the origin per RFC 3986 §6.2.3 before comparing.Changes
Connect.md— issuer documented as the bare Connect origin; the compatibility note now gives the real constraint (RFC 3986 §3.2.3) instead of the Databricks claim.MCP-Server.md— drops the:443cross-reference; names OpenAI Codex in the intro alongside Claude and Cursor; notes the Databricks redirect host is regional (oregon.cloud.databricks.com), soConnectAllowedHostsneeds the leading-dot suffix form.Docs only — no changelog entry, per convention for docs-only changes here.