The Databricks provider can already federate an OIDC token into a Databricks OAuth token, but only from the pod's Kubernetes service account (federated_k8s), read from disk. This adds a second subject-token source: a federated_token_provider connection extra, a dotted path to a Callable[[], str] that returns the OIDC JWT in-process, which the hook exchanges for a Databricks OAuth token through the same RFC 8693 token-exchange endpoint the federated_k8s path uses. No long-lived secret is stored, the subject token is never written to disk, and the source works in any environment (not only Kubernetes) with any issuer a Databricks federation policy trusts.

Why a token provider callable

The subject token is a short-lived, per-workload OIDC JWT that has to be minted fresh at connect time, so a static value in the connection extra would not work (it would be a stored long-lived secret that never refreshes). A callable lets a control plane vend a fresh token per task, in-process. This mirrors the OpenAI provider's token_provider custom source (#69069) and resolves the dotted path with import_string, the same pattern other providers use for callables in connection config.

Because the callable is imported and executed in the process running the hook, point it only at trusted code. The connection extra is an operator/admin surface.

Design notes

• client_id is optional for this path: include it for a service principal federation policy, or omit it for an account-wide policy (an account-wide policy is what lets the issuer stamp a per-workload subject claim). The Kubernetes path is unchanged: client_id stays required (service account tokens cannot carry custom claims) and is still validated before the token is read.
• The async path offloads the synchronous, usually network-bound provider call to a worker thread with run_in_executor, so it cannot stall the triggerer event loop used by deferrable operators.
• No connector version bump: the exchange reuses the existing raw requests call to /oidc/v1/token, identical to the shipped Kubernetes path.
• Like the other extra-based auth methods, this path is only used when no higher-precedence credential (a PAT, token, Azure credentials, or service_principal_oauth) is set on the connection.

Usage

{
  "conn_type": "databricks",
  "host": "my-workspace.cloud.databricks.com",
  "extra": {
    "federated_token_provider": "my_package.identity.get_oidc_token"
  }
}

Add client_id for a service principal federation policy; omit it for an account-wide policy.