DEV Community: Ivan Vydrin

Resolve tenant membership before a Databricks SQL call

Ivan Vydrin — Mon, 09 Nov 2026 05:53:19 +0000

A tenant ID in a route identifies the tenant the caller requested. Before you run SQL, check the authenticated caller against your membership store.

I maintain LakeWright.NET, an independent open-source project. This example uses its published 3.0.0 Core and Databricks packages in a .NET 8 console app. It checks membership, creates a tenant context for an allowed request, and runs a parameterized query. You can keep your own identity provider and membership store. The example runs without Signalboard or PostgreSQL.

View LakeWright.NET on GitHub

Run an allowed query and a denied request

Install the .NET 8 SDK. Download the companion project and extract it. The source directory is pinned to the tested revision. Run from the extracted project directory:

dotnet restore --configfile NuGet.Config
dotnet run -c Release -- --offline

The output is:

ALLOW: member-alice -> Acme; tenant-scoped query returned 1.
DENY: member-alice -> Globex; membership denied; no statement sent; transport requests remain 1.
OFFLINE_OK: published 3.0.0; no workspace credentials or external network calls.

Restore downloads packages. The executable then talks only to its own loopback HTTP fixture. It checks the allowed request's catalog, schema, SQL and bound value. Alice's request for Globex returns no context, so the example stops before constructing a statement. The transport count stays at one.

This is a console fixture. It does not host an ASP.NET endpoint or capture an HTTP 404.

Watch the LakeWright demo on YouTube

Resolve membership before constructing the statement

The relevant part of the compiled example is:

var tenant = await resolver.ResolveAsync(MembershipResolver.Acme, PrincipalId, ct)
    ?? throw new InvalidOperationException("The fixture member was not resolved.");
var result = await executor.ExecuteAsync(
    TenantScopedStatement.Create(tenant, "SELECT :value AS value",
        StatementParameter.Int("value", 1)), ct);

resolver and executor come from dependency injection. MembershipResolver.Acme and PrincipalId are demonstration identities defined in the project. The resolver checks a server-owned (tenant, principal) mapping before calling ITenantContextFactory.

In your application, replace that mapping with your trusted membership lookup. Obtain the principal from the authenticated server identity. Load the catalog and schema from stored tenant configuration. A caller-supplied tenant ID or principal string cannot establish membership.

Register your resolver with AddLakeWrightTenancy<YourMembershipResolver>(). Keep the context factory inside that trusted application layer. An endpoint should ask the resolver for a context and stop if it receives null. The guide uses a 404 policy for that case.

Keep the SQL in trusted application code

StatementParameter.Int("value", 1) binds a value. The SQL text stays constant. Use parameters for values rather than building SQL by concatenation.

A tenant context sets the default catalog and schema for the statement. SQL can still name another catalog or schema explicitly. Use Databricks grants to enforce the storage boundary, and keep caller-supplied or Genie-generated SQL out of this execution path.

The fixture tests the application's membership boundary and one serialized query. Separate server-side tenant schemas, exports and stored statement-ID ownership need their own checks.

Connect to a workspace after the local check

The existing-application guide lists warehouse access, catalog/schema permissions and credential choices. The provided executable has no live switch. Adapting it for your application means replacing the fixture transport and membership data after those prerequisites are available.

On 7 November 2026, a separate installed 3.0.0 .NET 8 consumer passed a bounded check in a nonproduction AWS workspace. A custom TokenCredential adapter forwarded the selected Databricks CLI user's OAuth token. The bound query returned 1. Wrong-tenant membership denial and default-statement rejection added zero SQL calls.

That check did not exercise Azure managed identity, business tables, billing or jobs. Its sample catalog/schema did not establish isolation between separate server-side tenant schemas. The compatibility record records the tested path.

When setup fails

Symptom	Check
The application asks for `--offline`	This companion deliberately has no live mode. Use the guide when adapting it.
The allowed fixture request fails	Run from the complete extracted project, including its local build and NuGet configuration.
A real caller cannot resolve membership	Check the authenticated principal and trusted membership mapping before changing SQL or grants.
Retargeting to .NET 10 produces `NU1605`	Align the direct Configuration and DependencyInjection package pins with the tested .NET 10 adaptation.

Both .NET 8 and .NET 10 consumers passed the offline allow/deny fixture. The companion README includes the .NET 10 adaptation; it keeps LakeWright at 3.0.0 and aligns the direct Microsoft.Extensions dependencies.

If you also use LakeWright's durable-operation modules, read ADR 0033 before upgrading to 3.0.0. Admission rejects caller-owned RepeatableRead and Serializable transactions. Invoke ClaimNextAsync outside that caller transaction, or use ReadCommitted. Commit a returned claim before submitting remote work. After the deletion grace period, purge may discard unclaimed Pending entries that were never submitted. Other incomplete work still blocks purge. The Core/Databricks console example does not exercise those optional flows.

Call Databricks Genie from C# with LakeSpeak

Ivan Vydrin — Mon, 09 Nov 2026 05:52:28 +0000

A Genie question takes more than one API call. Your app starts a conversation, waits for Genie to finish, then reads the answer, SQL, or rows it returns.

I maintain LakeSpeak.NET, an independent open-source project. In this walkthrough, a .NET 8 console app uses LakeSpeak.Genie 0.4.0. Run it against a local HTTP fixture first, then use the same client with a Genie Agent you can access.

View LakeSpeak.NET on GitHub

Run the example before configuring a workspace

Install the .NET 8 SDK. The first run needs NuGet access. It does not need a Databricks account or the LakeSpeak CLI.

Download the companion project and extract it. The source directory is pinned to the tested revision. Run these commands inside the extracted project:

dotnet restore --locked-mode --source https://api.nuget.org/v3/index.json
dotnet build -c Release --no-restore
dotnet run -c Release --no-build --no-restore -- --fixture

The output is:

OFFLINE HTTP fixture: no workspace, credentials, or Databricks CLI calls.
There were 42 orders yesterday.
SQL: SELECT count(*) AS order_count FROM orders WHERE order_date = current_date() - 1
order_count
42
OFFLINE fixture PASS (published LakeSpeak.Genie 0.4.0).

FixtureHandler supplies the conversation and query-result responses in memory. The installed client parses those responses. The companion checks the returned SQL and one complete row containing 42. The SQL shown here is fixture data. This command does not execute it against a warehouse.

Watch the LakeSpeak demo on YouTube

Register the client in your application

The live path uses these registrations:

var services = new ServiceCollection();
services.AddDatabricksCliAuthentication(profileName);
services.AddLakeSpeak(options => options.Profile = profileName);

using var provider = services.BuildServiceProvider();
var genie = provider.GetRequiredService<IGenieClient>();
var response = await genie.AskAsync(
    agentId, question, cancellationToken: cancellationToken);

The complete project includes the using directives and argument handling. In a hosted application, use your existing dependency-injection container and supply the cancellation token from the request or background task.

The response can contain answer text, generated SQL and a tabular result. Genie can also ask for clarification. Check whether a result exists before using its rows. The example prints an incomplete-result warning and exits with code 1 if the result is truncated.

Ask an existing Agent

For a live question, you need:

The Databricks CLI available to the process.
An existing Genie Agent shared with your identity.
Permission to use the Agent's warehouse and underlying data.

Copy the Agent's ID from Databricks. This console example does not resolve display names. Replace YOUR_WORKSPACE_HOST and YOUR_AGENT_ID before running these commands:

databricks auth login --host "https://YOUR_WORKSPACE_HOST" --profile my-workspace
dotnet run -c Release --no-build --no-restore -- my-workspace "YOUR_AGENT_ID" "How many orders were placed yesterday?"

The selected CLI profile owns login and token refresh. Check DATABRICKS_HOST too: an existing environment value can override the profile's host. The authentication guide documents that precedence and the OAuth M2M path for unattended applications.

A live question creates conversation history and can use warehouse compute. Inspect the returned SQL and compare the answer with a result you understand before relying on it.

When setup fails

Symptom	Check
The process cannot find `databricks`	Confirm the CLI is installed and on the PATH inherited by the application.
The request reaches the wrong workspace	Check the selected profile and any `DATABRICKS_HOST` override.
The Agent is not found or access is denied	Check that you passed an ID, then check Agent sharing, warehouse access and data permissions for that identity.
The response has text but no rows	Read the response. It may be a clarification rather than a completed query result.
The .NET SDK cannot be selected	The companion pins a .NET 8 SDK. Use its README's tested .NET 10 adaptation if you are working on .NET 10.

What the tests covered

The published 0.4.0 client passed this offline fixture on .NET 8 and .NET 10. A separate installed .NET 8 consumer also completed one live synthetic question in a nonproduction AWS workspace. Its existing starter Agent generated SELECT 1 AS probe_value and returned one complete row containing 1.

The current-source .NET 10 M2M suite passed all nine live tests on 7 November 2026. That suite covers questions, follow-up, re-execution, feedback and client cancellation. It is separate from the installed-package check. Client cancellation does not establish that remote warehouse work stopped.

These checks do not establish business-answer accuracy or GCP compatibility. The compatibility record keeps the dated checks and their limits.

Choosing the client or the CLI

The official Databricks CLI already provides Genie terminal commands. Use the .NET client when the conversation belongs inside your C# application. Databricks also provides native benchmark evaluations.

LakeSpeak's separate Question Pack CLI supports versioned questions and reviewable reports. In 0.4.0, behavior.requireQueryResult: true makes a pack reject missing or truncated results. A complete zero-row result succeeds. The default is false; this setting does not judge whether an answer is correct.