SSO to Databricks with Okta

This article shows how to configure Okta as the identity provider for single sign-on (SSO) in your Databricks account. Okta supports both OpenID Connect (OIDC) and SAML 2.0. To sync users and groups from Okta, see Sync users and groups from your identity provider.

The following demos walk you through configuring SSO with Okta:

• Secure Your Databricks Access with OIDC SSO

• Secure Your Databricks Access with SAML SSO

Warning

To prevent getting locked out of Databricks during single sign-on testing, Databricks recommends keeping the account console open in a different browser window. You can also configure emergency access with security keys to prevent lockout. See Emergency access to prevent lockouts.

Enable Okta single sign-on using OIDC

1. As an account owner or account admin, log in to the account console and click the Settings icon in the sidebar.

2. Click the Authentication tab.

3. Next to Authentication, click Manage.

4. Choose Single sign-on with my identity provider.

5. Click Continue.

6. Under Identity protocol, select OpenID Connect.

7. On the Authentication tab, make note of the Databricks Redirect URL value.

8. In a new browser tab, log into Okta as an administrator.

9. In the home page, click Applications > Applications.

10. Click Create App Integration.

11. Select OIDC - OpenID Connect and Web Application and click Next.

12. In New Web App Integration, under Sign-in redirect URIs, enter the Databricks Redirect URL from step 4. You can choose to configure the other settings or you can leave them to their default values.

13. Click Save

14. Under the General tab, copy the client ID and client secret generated by Okta for the application.

    • Client ID is the unique identifier for the Databricks application you created in your identity provider.

    • Client secret is a secret or password generated for the Databricks application that you created. It is used to authorize Databricks with your identity provider.

15. Under the Sign On tab, in OpenID Connect ID Token copy the Okta URL in the issuer field.

    If the issuer field says Dynamic, click Edit and choose Okta URL (url) in the drop down.

    This URL is the URL where you can find Okta’s OpenID Configuration Document. That OpenID Configuration Document must found be in {issuer-url}/.well-known/openid-configuration.

    Remove the /.well-known/openid-configuration ending from the URL. You can specify query parameters by appending them to the issuer URL, for example {issuer-url}?appid=123.

16. Click the Assignments tab. Databricks recommends adding the Okta group named Everyone to the application. This ensures all users in your organization can access the Databricks account.

17. Return to the Databricks account console Authentication tab and enter values you copied from the identity provider application to the Client ID, Client secret, and Issuer URL fields.

18. Optionally, enter a Username claim if you want to use a claim other than email as users’ Databricks usernames. See your identity provider’s documentation for specific information on claim values.

    

19. Click Save.

20. Click Test SSO to validate that your SSO configuration is working properly.

21. Click Enable SSO to enable single sign-on for your account.

22. Test account console login with SSO.

23. Configure unified login

    Unified login allows you to use the account console SSO configuration in your Databricks workspaces. If your account was created after June 21, 2023, unified login is enabled on your account by default for all workspaces, new and existing, and it cannot be disabled. To configure unified login, see Enable unified login.

Enable Okta single sign-on using SAML

Follow these steps to create an Okta SAML application for use with Databricks account console.

1. As an account owner or account admin, log in to the account console and click the Settings icon in the sidebar.

2. Click the Authentication tab.

3. Next to Authentication, click Manage.

4. Choose Single sign-on with my identity provider.

5. Click Continue.

6. Under Identity protocol, select SAML 2.0.

7. On the Authentication tab, make note of the the Databricks redirect URL.

   

8. In a new browser tab, log into Okta as an administrator.

9. Go to Applications and click Browse App Catalog.

10. Search for Databricks in the Browse App Integration Catalog.

11. Click Add integration.

12. Select the Sign On tab and click Edit.

13. Under Advanced sign-on settings, Configure the application using the following settings:

    • Databricks SAML URL: the Databricks redirect URL you copied above.

    • Application username format: Email

14. Click Save. The Databricks SAML app is shown.

15. Under SAML 2.0 is not configured until you complete the setup instructions, click View Setup Instructions.

16. Copy the following values:

    • Identity Provider Single Sign-On URL

    • Identity Provider Issuer

    • x.509 certificate

17. Click the Assignments tab. Databricks recommends adding the Okta group named Everyone to the application. This ensures all users in your organization can access the Databricks account.

18. Configure Databricks in the Databricks account console SSO page.

    1. Set the SSO type drop-down to SAML 2.0.

    2. Set Single Sign-On URL to the Okta field called Login URL.

    3. Set Identity Provider Entity ID to the Okta field that was called Identity Provider Issuer.

    4. Set x.509 Certificate to the Okta x.509 certificate, including the markers for the beginning and ending of the certificate.

    5. Click Save.

    6. Click Test SSO to validate that your SSO configuration is working properly.

    7. Click Enable SSO to enable single sign-on for your account.

    8. Test account console login with SSO.

19. Configure unified login

    Unified login allows you to use the account console SSO configuration in your Databricks workspaces. If your account was created after June 21, 2023, unified login is enabled on your account by default for all workspaces, new and existing, and it cannot be disabled. To configure unified login, see Enable unified login.