Skip to main content
Last updated on

Access data shared with you using OpenSharing (for recipients)

This page explains how to access data that has been shared with you using OpenSharing. OpenSharing supports multiple sharing models:

  • Databricks-to-Databricks sharing, for Databricks workspace users with Unity Catalog
  • Databricks-to-Open sharing, for any recipient using any tool
  • Open-to-Databricks sharing, for providers using the open-source OpenSharing protocol sharing with recipients using Databricks

OpenSharing and data recipients​

OpenSharing is an open standard for secure data sharing. A Databricks user, referred to as a data provider in this context, can use OpenSharing on Databricks to share data with a person or group outside of their organization, called a data recipient.

Sharing protocols​

How you access the data depends on whether you yourself are a Databricks user and whether or not your data provider configured the data being shared with you for Databricks-to-Databricks sharing, Databricks-to-Open sharing, or Open-to-Databricks sharing.

In the Databricks-to-Databricks model, you must be a user on a Databricks workspace that is enabled for Unity Catalog. A member of your team provides the data provider with a unique identifier for your Unity Catalog metastore, and the data provider uses that to create a secure sharing connection. The shared data becomes available for access in your workspace. If necessary, a member of your team configures granular access control on that data.

In the Databricks-to-Open sharing model, you can use any tool you like (including Databricks) to access the shared data. The data provider sends you an activation URL or a portal link over a secure channel. You follow it to download a credential file or URL that lets you access the data shared with you.

The shared data is not provided by Databricks directly but by data providers running on Databricks.

In the Open-to-Databricks model, you can use Databricks to access data shared by a data provider using the open-source OpenSharing protocol. Your data provider sends you a credential file over a secure channel that you upload to Databricks. Using Catalog Explorer or a notebook, you can access the data shared with you.

note

Databricks may collect information about data recipients' use of and access to the shared data (including identifying any individual or company who accesses the data using the credential file in connection with such information) and may share it with the applicable data provider.

Get access to the data shared with you​

How you access the data depends on which sharing protocol your provider used.

Get access in the Databricks-to-Databricks model​

tip

Use VPC gateway endpoints or interface endpoints for S3 instead of NAT gateways for in-region storage access whenever possible to reduce costs and enhance security.

In the Databricks-to-Databricks model, you access data differently depending on how your provider shared data with you.

After you have access to the data, you or someone on your team can configure granular data access on that data for your users. See Read data shared using Databricks-to-Databricks OpenSharing (for recipients).

Access using email​

Beta

This feature is in Beta. Workspace admins can control access to this feature from the Previews page. See Manage Databricks previews.

If your provider shared data using email, Databricks sends you an email with the subject "<Organization> has shared data with you". The email includes a secure activation link. If your provider allowed both Databricks and open sharing, you can choose how to access the data.

To accept these shares:

  1. Open the email and click Use an existing Databricks account or Create a free Databricks account.
  2. Log in to or create your Databricks account using the same email address that received the OpenSharing email.
  3. You must have the CREATE PROVIDER privilege at the metastore level on Databricks. Request permission if needed and wait for a metastore admin to grant you the privilege.
  4. Specify the metastore the shares should be in.

Access using sharing identifier​

If a provider asks to share data with you using a sharing identifier, you must find the identifier for a Unity Catalog metastore attached to the workspace of your choice. Send it to your provider so they can create a recipient object that represents you. After they create shares and grant you access, you automatically gain read-only access to the data.

The sharing identifier is a string consisting of the metastore's cloud, region, and UUID (the unique identifier for the metastore), in the format <cloud>:<region>:<uuid>.

For example, in the following screenshot, the complete sharing identifier is aws:us-west-2:19a84bee-54bc-43a2-87de-023d0ec16016.

example of a sharing identifier in Catalog Explorer

Find your sharing identifier using Catalog Explorer, the Databricks Unity Catalog CLI, or the CURRENT_METASTORE SQL function in a Databricks notebook or Databricks SQL query.

  1. In your Databricks workspace, click Data icon. Catalog.

  2. At the top of the Catalog pane, click the Gear icon. gear icon and select OpenSharing.

    Alternatively, in the upper-right corner, click Share > OpenSharing.

  3. On the Shared with me tab, click your Databricks sharing organization name in the upper right, and select Copy sharing identifier.

Get access in the Databricks-to-Open sharing model​

In the Databricks-to-Open sharing model:

  1. The data provider sends you an activation URL or a portal URL over a secure channel, or Databricks sends you an email. An email invitation can't be forwarded. Follow the link to download a credential file or to access the data shared with you.

    Both bearer tokens and OAuth Client Credentials are supported.

    important

    Don't share the activation link with anyone. You can download a credential file only once. If you visit the activation link again after the credential file has already downloaded, the Download Credential File button is disabled.

    If you lose the activation link before you use it, contact the data provider.

  2. Store the credential file in a secure location.

    Don't share the credential file with anyone outside the group of users who should have access to the shared data. If you need to share it with someone in your organization, Databricks recommends using a password manager.

Get access in the Open-to-Databricks model​

In the Open-to-Databricks model:

  1. The data provider uses the open-source OpenSharing protocol to create shares and add assets to the share.

  2. The data provider sends you either an activation URL (over a secure channel) or a portal URL. You follow it to download a credential file or a URL that lets you access the data shared with you.

    Both bearer tokens and OAuth Client Credentials are supported.

    important

    Don't share the activation link with anyone. You can download a credential file only once. If you visit the activation link again after the credential file has already downloaded, the Download Credential File button is disabled.

    If you lose the activation link before you use it, contact the data provider.

  3. Store the credential file on your Databricks workspace.

    Don't share the credential file with anyone outside the group of users who should have access to the shared data.

Read the shared data​

How you read data that has been shared securely with you using OpenSharing depends on whether you received a credential file or you are using a Databricks workspace and you provided the data provider with your sharing identifier (the Databricks-to-Databricks model).

note

If you get an error that says a data asset does not exist when trying to read your shares, see Data asset "does not exist" error.

Read shared data using a credential file (Databricks-to-Open sharing or Open-to-Databricks sharing)​

If data has been shared with you using bearer tokens, use the credential file that you downloaded to authenticate to the data provider's account and read the shared data. Access persists as long as the underlying token is valid and the provider continues to share the data. Providers manage token expiration and rotation. Tokens are valid for a maximum of one year after creation. Updates to the data are available to you in near real time. You can read and make copies of the shared data, but you can't modify the source data.

To use Databricks to access and read shared data, see Import a provider and read shared data in Databricks.

To use Apache Spark, pandas, and Power BI to access and read shared data, see Read data shared with bearer tokens.

Read shared data using a OIDC federation (Databricks-to-Open sharing)​

If data has been shared with you using the Databricks-to-Open sharing protocol with OIDC federation, you use the URL that was sent to you to authenticate to the data provider's account and read the shared data. Access persists as long as the provider continues to share the data. Updates to the data are available to you in near real time. You can read and make copies of the shared data, but you can't modify the source data.

To learn how to access and read shared data using the OIDC token federation flow in Tableau and Power BI, see Read data shared using Open ID Connect (OIDC) federation in a U2M flow. To learn how to access and read shared data using the OIDC token federation flow in a Python client app, see Read data shared using Open ID Connect (OIDC) federation in an M2M flow.

Read shared data using Databricks-to-Databricks sharing​

If data has been shared with you using the Databricks-to-Databricks model, then no credential file is required to access the shared data. Databricks takes care of the secure connection, and the shared data is automatically discoverable in your Databricks workspace.

To learn how to find, read, and manage that shared data in your Databricks workspace, see Read data shared using Databricks-to-Databricks OpenSharing (for recipients).

Audit usage of shared data​

If you have access to a Databricks workspace, you can use Databricks audit logs to understand who in your organization is accessing which data using OpenSharing. See Audit and monitor data sharing.

Additional resources​

On this page