Bundle and current-user commands fail with 404 SCIM_404 ("No user found with ID <group-id>") when authenticated as a role (RBAC Public Preview)

[SGA-reona-hoshino]

Describe the issue

When authenticated to a workspace as a role (RBAC Public Preview, where a role is backed by a group) via databricks auth login (selecting the role in the browser flow), any command that resolves the current user fails:

Error: Could not handle request. Failed to getMe in common handler. No user found with ID <group-id>. (404 SCIM_404)
Endpoint: GET https://<workspace-url>/api/2.0/preview/scim/v2/Me?
HTTP Status: 404 Not Found
API error_code: SCIM_404

The ID in the error is the ID of the group backing the assumed role, not a user ID. The SCIM /Me endpoint apparently tries to resolve the caller as a user, but the token principal is a group, so the lookup 404s.

This is not limited to current-user me. All bundle commands (including bundle validate) fail at initialization, because the bundle library unconditionally resolves the current user via SCIM /Me to populate workspace.current_user — even when the bundle configuration does not reference ${workspace.current_user} at all. As a result, Databricks Asset Bundles are entirely unusable when authenticated as a role.

Steps to reproduce

1. Enable the RBAC preview (account + workspace level) and have Assume permission on a role (group) in the workspace.
2. databricks auth login --host <workspace-url> -p MAINTAINER and select the role (not the user identity) in the browser.
3. Run either of:
   • databricks current-user me -p MAINTAINER
   • databricks bundle validate -t prod -p MAINTAINER

Expected behavior

One of:

• SCIM /Me (and workspace.current_user) resolves to the assumed role's principal (the group), or
• bundle commands skip current-user resolution when the config does not reference ${workspace.current_user}, or
• the CLI returns a clear error stating that this operation is unsupported when acting as a role.

Neither the switch-roles docs (which document the CLI login flow) nor the RBAC limitations page mention this limitation. If this is a known backend limitation of the preview, documenting it (and having bundle fail with an actionable message) would already help.

Actual behavior

Error: Could not handle request. Failed to getMe in common handler. No user found with ID <group-id>. (404 SCIM_404)
Endpoint: GET https://<workspace-url>/api/2.0/preview/scim/v2/Me?
HTTP Status: 404 Not Found
API error_code: SCIM_404
API message: Could not handle request. Failed to getMe in common handler. No user found with ID <group-id>.

Environment

• Databricks CLI version: v1.12.1
• OS: macOS 26.6.2
• Cloud: AWS
• Auth type: OAuth U2M (databricks auth login), role selected in browser
• RBAC Public Preview: enabled

Additional context

• Authenticating the same host as my user identity works as expected; only role-scoped tokens fail.
• Calling the endpoint directly reproduces the error, so the failure is server-side; this issue is about the CLI's hard dependency on /Me making bundles unusable under RBAC:
  databricks api get /api/2.0/preview/scim/v2/Me -p MAINTAINER → same 404 SCIM_404.
• Related: PR Add --group-id flag to assume a group during OAuth login #5822 adds a --group-id flag to assume a group during OAuth login. Once that lands, this bug becomes more visible, since role login gets easier while bundles still cannot run under a role.