If unified login is enabled, your workspaces will use the same SSO configuration as your account. Workspace-level SSO can only be configured when unified login is disabled. See Unified login.
This article shows how to configure Okta as the identity provider for a Databricks workspace. To configure SSO in your Databricks account, see Set up SSO in your Databricks account console.
Log in to Databricks as an administrator.
Go to the admin settings page.
Click Single Sign On.
Copy the Databricks SAML URL.
Do not close this browser tab.
In a new browser tab, log into Okta as an administrator.
In the home page, click Applications > Applications.
Click Create App Integration.
Select SAML 2.0 and click Next.
Set App name to Databricks SSO and click Next.
Configure the application using the following settings:
Single Sign On URL: the Databricks SAML URL from Gather required information
Audience URI: the Databricks SAML URL from Gather required information
Name ID Format: EmailAddress
Application Username: Email
Email addresses in Databricks are case sensitive. Before enabling SSO, verify that email addresses for existing Databricks users match exactly with the email addresses in Okta.
Click Advanced settings. Ensure that Response is set to Signed (the default). Signing the assertion is optional. Do not modify other advanced settings.
Assertion encryption must be set to Unencrypted.
Click Hide advanced settings.
Select I’m an Okta customer adding an internal app.
Click Finish. The Databricks SAML app is shown.
Under SAML 2.0 is not configured until you complete the setup instructions, click View Setup Instructions.
Copy the following values:
Identity Provider Single Sign-On URL
Identity Provider Issuer
Go back to the browser tab for Databricks.
In the admin settings page, click Single Sign On.
Set Single Sign-On URL to the Identity Provider Single Sign-On URL from Okta.
Set Identity Provider Entity ID to the Identity Provider Issuer from Okta.
Set x.509 Certificate to the x.509 certificate from Okta, including the markers for the beginning and ending of the certificate.
Click Enable SSO.
Optionally, click Allow auto user creation.
In an incognito browser window, go to your Databricks workspace.
Click Single Sign On. You are redirected to Okta.
Log in to Okta. If SSO is configured correctly, you are redirected to Databricks.
If the test fails, review Troubleshooting.