access_control_list validation prevents assinging service_principal_name to Workflow permissions

[jford-ctm]

Expected Behavior

A Workflow/Job Access Control List should allow a Service Principal Name to be granted Permissions when Creating a new Job.

API spec from https://docs.databricks.com/api-explorer/workspace/jobs/create:

"access_control_list": [
  {
    "user_name": "string",
    "group_name": "string",
    "service_principal_name": "string",
    "permission_level": "CAN_MANAGE"
  }
],

Current Behavior

Error generated when deploying an ACL that uses 'service_principal_name':

At least one of the following fields should be provided in the payload: ['user_name', 'group_name'].
Provided payload: {'service_principal_name': '37d50...3b9ffc5f9', 'permission_level': 'IS_OWNER'}
(type=value_error)

access_control.py (dbx/models/workflow/common/access_control.py) has no notion of 'service_principal_name':

class AccessControlRequest(FlexibleModel):
    user_name: Optional[str]
    group_name: Optional[str]
    permission_level: PermissionLevel

    _one_of_provided = root_validator(pre=True, allow_reuse=True)(
        lambda _, values: at_least_one_of(["user_name", "group_name"], values)
    )

Steps to Reproduce (for bugs)

Deploy a Job with

access_control_list:
  - service_principal_name: "{{valid_applicationId}}"
    permission_level: "IS_OWNER"

Context

This worked for dbx version>=0.7,< 0.8

Your Environment

• dbx version used: >=0.8
• Databricks Runtime version: current

[renardeinside]

resolved and released in 0.8.14. Thanks a lot for raising this one @jford-ctm !