Federation Policy

FederationPolicy object

namestring: Name of the federation policy. A recipient can have multiple policies with different names. The name must contain only lowercase alphanumeric characters, numbers, and hyphens.
Example: my-federation-policy1

oidc_policyobject

Specifies the policy to use for validating OIDC claims in the federated tokens.

Show child attributesHide child attributes

issuerstring: The required token issuer, as specified in the 'iss' claim of federated tokens.
Example: https://myidp.example.com/oidc

subject_claimstring

The claim that contains the subject of the token. Depending on the identity provider and the use case (U2M or M2M), this can vary:

For Entra ID (AAD):
- U2M flow (group access): Use groups.
- U2M flow (user access): Use oid.
- M2M flow (OAuth App access): Use azp.
For other IdPs, refer to the specific IdP documentation.

Supported subject_claim values are:

oid: Object ID of the user.
azp: Client ID of the OAuth app.
groups: Object ID of the group.
sub: Subject identifier for other use cases.

Example: azp

subjectstring

The required token subject, as specified in the subject claim of federated tokens. The subject claim identifies the identity of the user or machine accessing the resource. Examples for Entra ID (AAD):

U2M flow (group access): If the subject claim is groups, this must be the Object ID of the group in Entra ID.
U2M flow (user access): If the subject claim is oid, this must be the Object ID of the user in Entra ID.
M2M flow (OAuth App access): If the subject claim is azp, this must be the client ID of the OAuth app registered in Entra ID.

audiencesarray of string: The allowed token audiences, as specified in the 'aud' claim of federated tokens. The audience identifier is intended to represent the recipient of the token. Can be any non-empty string value. As long as the audience in the token matches at least one audience in the policy,

create_timestring: System-generated timestamp indicating when the policy was created.

commentstring: Description of the policy. This is a user-provided description.
Example: My federation policy description.

update_timestring: System-generated timestamp indicating when the policy was last updated.

idstring: Unique, immutable system-generated identifier for the federation policy.

View as Markdown

The FederationPolicy object

{
  "name": "my-federation-policy1",
  "oidc_policy": {
    "issuer": "https://myidp.example.com/oidc",
    "subject_claim": "azp",
    "subject": "string",
    "audiences": [
      "string"
    ]
  },
  "create_time": "string",
  "comment": "My federation policy description.",
  "update_time": "string",
  "id": "string"
}

Get

GET /api/2.0/data-sharing/recipients/{recipient_name}/federation-policies/{name}

Reads an existing federation policy for an OIDC_FEDERATION recipient for sharing data from <Databricks> to non-<Databricks> recipients. The caller must have read access to the recipient.

API scopes: sharing

Parameters

recipient_namestringpath: Name of the recipient. This is the name of the recipient for which the policy is being retrieved.

namestringpath: Name of the policy. This is the name of the policy to be retrieved.

Response

Returns the FederationPolicy object.

View as Markdown

Response

{
  "name": "my-federation-policy1",
  "oidc_policy": {
    "issuer": "https://myidp.example.com/oidc",
    "subject_claim": "azp",
    "subject": "string",
    "audiences": [
      "string"
    ]
  },
  "create_time": "string",
  "comment": "My federation policy description.",
  "update_time": "string",
  "id": "string"
}

List

GET /api/2.0/data-sharing/recipients/{recipient_name}/federation-policies

Lists federation policies for an OIDC_FEDERATION recipient for sharing data from <Databricks> to non-<Databricks> recipients. The caller must have read access to the recipient.

API scopes: sharing

Parameters

recipient_namestringpath: Name of the recipient. This is the name of the recipient for which the policies are being listed.

max_resultsint32query

page_tokenstringquery

Response

Returns a list of FederationPolicy objects.

View as Markdown

Response

{
  "policies": [
    {
      "name": "my-federation-policy1",
      "oidc_policy": {},
      "create_time": "string",
      "comment": "My federation policy description.",
      "update_time": "string",
      "id": "string"
    }
  ],
  "next_page_token": "string"
}

Create

POST /api/2.0/data-sharing/recipients/{recipient_name}/federation-policies

Create a federation policy for an OIDC_FEDERATION recipient for sharing data from <Databricks> to non-<Databricks> recipients. The caller must be the owner of the recipient. When sharing data from <Databricks> to non-<Databricks> clients, you can define a federation policy to authenticate non-<Databricks> recipients. The federation policy validates OIDC claims in federated tokens and is defined at the recipient level. This enables secretless sharing clients to authenticate using OIDC tokens.

Supported scenarios for federation policies:

User-to-Machine (U2M) flow (e.g., PowerBI): A user accesses a resource using their own identity.
Machine-to-Machine (M2M) flow (e.g., OAuth App): An OAuth App accesses a resource using its own identity, typically for tasks like running nightly jobs.

For an overview, refer to:

Blog post: Overview of feature: https://www.databricks.com/blog/announcing-oidc-token-federation-enhanced-delta-sharing-security

For detailed configuration guides based on your use case:

Creating a Federation Policy as a provider: https://docs.databricks.com/en/delta-sharing/create-recipient-oidc-fed
Configuration and usage for Machine-to-Machine (M2M) applications (e.g., Python Delta Sharing Client): https://docs.databricks.com/aws/en/delta-sharing/sharing-over-oidc-m2m
Configuration and usage for User-to-Machine (U2M) applications (e.g., PowerBI): https://docs.databricks.com/aws/en/delta-sharing/sharing-over-oidc-u2m

API scopes: sharing

Parameters

recipient_namestringpath: Name of the recipient. This is the name of the recipient for which the policy is being created.

Request body

policyobject

Name of the policy. This is the name of the policy to be created.

Show child attributesHide child attributes

namestring: Name of the federation policy. A recipient can have multiple policies with different names. The name must contain only lowercase alphanumeric characters, numbers, and hyphens.
Example: my-federation-policy1

oidc_policyobjectRequired

Specifies the policy to use for validating OIDC claims in the federated tokens.

Show child attributesHide child attributes

issuerstring: The required token issuer, as specified in the 'iss' claim of federated tokens.
Example: https://myidp.example.com/oidc

subject_claimstring

The claim that contains the subject of the token. Depending on the identity provider and the use case (U2M or M2M), this can vary:

For Entra ID (AAD):
- U2M flow (group access): Use groups.
- U2M flow (user access): Use oid.
- M2M flow (OAuth App access): Use azp.
For other IdPs, refer to the specific IdP documentation.

Supported subject_claim values are:

oid: Object ID of the user.
azp: Client ID of the OAuth app.
groups: Object ID of the group.
sub: Subject identifier for other use cases.

Example: azp

subjectstring

U2M flow (group access): If the subject claim is groups, this must be the Object ID of the group in Entra ID.
U2M flow (user access): If the subject claim is oid, this must be the Object ID of the user in Entra ID.
M2M flow (OAuth App access): If the subject claim is azp, this must be the client ID of the OAuth app registered in Entra ID.

audiencesarray of string: The allowed token audiences, as specified in the 'aud' claim of federated tokens. The audience identifier is intended to represent the recipient of the token. Can be any non-empty string value. As long as the audience in the token matches at least one audience in the policy,

create_timestring: System-generated timestamp indicating when the policy was created.

commentstring: Description of the policy. This is a user-provided description.
Example: My federation policy description.

update_timestring: System-generated timestamp indicating when the policy was last updated.

idstring: Unique, immutable system-generated identifier for the federation policy.

Response

Returns the FederationPolicy object.

View as Markdown

Request

{
  "policy": {
    "name": "my-federation-policy1",
    "oidc_policy": {},
    "create_time": "string",
    "comment": "My federation policy description.",
    "update_time": "string",
    "id": "string"
  }
}

Response

{
  "name": "my-federation-policy1",
  "oidc_policy": {
    "issuer": "https://myidp.example.com/oidc",
    "subject_claim": "azp",
    "subject": "string",
    "audiences": [
      "string"
    ]
  },
  "create_time": "string",
  "comment": "My federation policy description.",
  "update_time": "string",
  "id": "string"
}

Delete

DELETE /api/2.0/data-sharing/recipients/{recipient_name}/federation-policies/{name}

Deletes an existing federation policy for an OIDC_FEDERATION recipient. The caller must be the owner of the recipient.

API scopes: sharing

Parameters

recipient_namestringpath: Name of the recipient. This is the name of the recipient for which the policy is being deleted.

namestringpath: Name of the policy. This is the name of the policy to be deleted.