Google Workspace (formerly GSuite) single sign-on (SSO v2.0)

Workspaces on the E2 version of the Databricks platform always use SSO version 2.0. All new Databricks accounts and most existing accounts are now E2. In addition, many workspaces on the ST version of the Databricks platform have been upgraded to SSO version 2.0. Therefore, most workspaces use SSO version 2.0, and should follow the instructions in this article.

If you’re not sure, follow these steps to check the SSO version your workspace uses:

  1. Go to the Admin Console and select the SSO tab.

  2. Look for the Single Sign-On header.

    SSO v2.0 Header

  3. If the number displayed to the right of the header is (v2.0), leave the browser tab open and proceed with the following instructions.

  4. If the number displayed to the right of the header is (v1.0), follow the Google Workspace single sign-on (SSO v1.0) instructions instead of the instructions in this article.

Gather required information

From the Databricks Single Sign-On tab, copy the Databricks SAML URL.

Do not close this browser tab.

Configure Google Workspace

  1. In a new browser tab, log in to the Google Workspace Admin console.

  2. In the sidebar, select Apps > Web and mobile apps.

    Open the Web and mobile apps page

  3. On the Web and mobile apps page, select Add App > Add custom SAML app to add a new SAML app.

    Add application

  4. Enter a name in the App name field and click Continue.

    Chose custom application

  5. Go to the Service provider detail page.

  6. Set both ACS URL and Entity ID to the Databricks SAML URL from Gather required information.

  7. (Required) Select Signed response.

  8. Set Name ID Format to EMAIL.

    Configure SAML application

  9. Click Continue.

  10. On the Google Identity Provider details page, copy the following SAML values under Option 2:

    • SSO URL
    • Entity ID
    • Certificate

  11. Complete the rest of the SAML app workflow in the Google Workspace Admin console.

Configure Databricks

  1. Go back to the browser tab for Databricks.
  2. In the admin console, click Single Sign On.
  3. Set Single Sign-On URL to the SSO URL from the Google Workspace app.
  4. Set Identity Provider Entity ID to the Entity ID from the Google Workspace app.
  5. Set x.509 Certificate to the certificate from the Google Marketplace Workspace, including the markers for the beginning and ending of the certificate.
  6. Click Enable SSO.
  7. Optionally, click Allow auto user creation.

Test the configuration

  1. In an incognito browser window, go to your Databricks workspace.
  2. Click Single Sign On. You are redirected to Okta.
  3. Log in to Okta. If SSO is configured correctly, you are redirected to Databricks.

If the test fails, review Troubleshooting.