Configure authentication for Okta

Beta

This feature is in Beta. To use it, a workspace admin must turn on Lakeflow Connect for Okta from the Previews page. See Manage Databricks previews.

To let the Lakeflow Connect Okta connector authenticate, create an SSWS API token in the Okta Admin Console. Use the API token and organization domain from these steps to create a Unity Catalog connection in Databricks.

Prerequisites

• An active Okta super administrator account. The connector reads administrator role assignments, profile mappings, global session policies, and the metadata of every API token in the organization. Among the standard Okta administrator roles, only the super administrator can view all of these. For details, see Administrators comparison table.
• Access to the Okta Admin Console.

note

An API token has the same permissions as the administrator who creates it. If that administrator's permissions change, the token's permissions change too. Okta rejects tokens that belong to deactivated users, and revokes tokens that aren't used for 30 days. For details, see Manage Okta API tokens.

Configure Okta

1. Sign in to the Okta Admin Console with the administrator account that owns the token.
2. Go to Security > API.
3. Click the Tokens tab.
4. Click Create token.
5. Enter a name for the token.
6. For API calls made with this token must originate from, select Any IP.
7. Click Create token.
8. Copy the SSWS API token. Okta doesn't display the token again.
9. Note your Okta organization domain, such as company-name.okta.com.

Next steps

Create an Okta connection in Databricks. See Create an Okta connection.