Skip to main content
Last updated on

current_oauth_custom_identity_claim function

Applies to: check marked yes Databricks SQL check marked yes Databricks Runtime 19.7 and above

Returns the custom identity claim in the OAuth token that authenticated the current session. An application adds the claim when it requests an OAuth token for a service principal. Use this function in a dynamic view or row filter function to filter data for each end user of the application. See Filter data per end user with OAuth custom identity claims.

Syntax​

current_oauth_custom_identity_claim()

Arguments​

This function takes no arguments.

Returns​

A STRING.

If the session wasn't authenticated with an OAuth token that carries a custom identity claim, the function returns NULL.

Notes​

  • Write every filter that uses this function so that a NULL claim matches no rows. Use plain equality, such as customer_name = current_oauth_custom_identity_claim(). Don't use IS NULL checks, coalesce, or the null-safe equality operator <=> on the claim. See Write filters that match no rows when the claim is NULL.
  • Use the claim only as a value to compare. Don't use it as a pattern in RLIKE, as an object name in IDENTIFIER, or as part of the SQL text that EXECUTE IMMEDIATE runs.
  • Databricks doesn't encrypt or interpret the claim. Anyone who holds the token can read it.

Examples​

SQL
-- A token created with custom_claim=acme
> SELECT current_oauth_custom_identity_claim();
 acme

-- A token without a custom claim
> SELECT current_oauth_custom_identity_claim();
 NULL

-- A dynamic view that returns only the caller's rows
> CREATE VIEW main.sales.customer_orders AS
    SELECT order_id, customer_name, product, order_date
    FROM main.sales.orders
    WHERE customer_name = current_oauth_custom_identity_claim();
On this page