databricks · hectorcast-db · Mar 13, 2026 · Mar 13, 2026 · Mar 13, 2026
diff --git a/databricks/sdk/config.py b/databricks/sdk/config.py
@@ -670,8 +670,10 @@ def _resolve_host_metadata(self) -> None:
         if not self.discovery_url and meta.oidc_endpoint:
             if "{account_id}" in meta.oidc_endpoint and not self.account_id:
                 raise ValueError("account_id is required to resolve discovery_url from host metadata")
-            logger.debug(f"Resolved discovery_url from host metadata: {meta.oidc_endpoint}")
-            self.discovery_url = meta.oidc_endpoint.replace("{account_id}", self.account_id or "")
+            # Metadata oidc_endpoint is the root for OIDC. Append the well-known path to form the full discovery URL.
+            base = meta.oidc_endpoint.replace("{account_id}", self.account_id or "").rstrip("/")
+            self.discovery_url = f"{base}/.well-known/oauth-authorization-server"
+            logger.debug(f"Resolved discovery_url from host metadata: {self.discovery_url}")
         if not self.cloud and meta.cloud:
             logger.debug(f"Resolved cloud from host metadata: {meta.cloud.value}")
             self.cloud = meta.cloud

diff --git a/tests/integration/conftest.py b/tests/integration/conftest.py
@@ -13,6 +13,11 @@
 from databricks.sdk.service.catalog import VolumeType
 
 
+@pytest.fixture(autouse=True)
+def stub_host_metadata():
+    """Override root conftest stub — integration tests hit real endpoints."""
+
+
 def pytest_addoption(parser):
     # make logging sensible and readable.
     parser.addini(

diff --git a/tests/integration/test_auth.py b/tests/integration/test_auth.py
@@ -13,6 +13,7 @@
 import pytest
 
 from databricks.sdk import AccountClient, WorkspaceClient
+from databricks.sdk.config import Config
 from databricks.sdk.service import iam, oauth2
 from databricks.sdk.service.compute import (ClusterSpec, DataSecurityMode,
                                             Library, ResultType, SparkVersion)
@@ -271,6 +272,16 @@ def test_wif_workspace(ucacct, env_or_skip, random):
     ws.current_user.me()
 
 
+def test_workspace_config_resolves_account_and_workspace_id(w, env_or_skip):
+    """Test that Config resolves account_id and workspace_id from host metadata."""
+    env_or_skip("CLOUD_ENV")
+
+    config = Config(experimental_is_unified_host=True)
+
+    assert config.account_id, "expected account_id to be resolved from host metadata"
+    assert config.workspace_id, "expected workspace_id to be resolved from host metadata"
+
+
 def test_workspace_oauth_m2m_auth(w, env_or_skip):
     env_or_skip("CLOUD_ENV")
 

diff --git a/tests/test_config.py b/tests/test_config.py
@@ -825,15 +825,17 @@ def test_databricks_oidc_endpoints_uses_discovery_url(requests_mock):
             {
                 "account_id": _DUMMY_ACCOUNT_ID,
                 "workspace_id": _DUMMY_WORKSPACE_ID,
-                "discovery_url": f"{_DUMMY_WS_HOST}/oidc",
+                "discovery_url": f"{_DUMMY_WS_HOST}/oidc/.well-known/oauth-authorization-server",
             },
             id="unified-populates-all-fields",
         ),
         pytest.param(
             _DUMMY_ACC_HOST,
             {"oidc_endpoint": f"{_DUMMY_ACC_HOST}/oidc/accounts/{{account_id}}"},
             {"account_id": _DUMMY_ACCOUNT_ID, "experimental_is_unified_host": True},
-            {"discovery_url": f"{_DUMMY_ACC_HOST}/oidc/accounts/{_DUMMY_ACCOUNT_ID}"},
+            {
+                "discovery_url": f"{_DUMMY_ACC_HOST}/oidc/accounts/{_DUMMY_ACCOUNT_ID}/.well-known/oauth-authorization-server"
+            },
             id="unified-substitutes-account-id",
         ),
         pytest.param(