Skip to main content

Share data using the Delta Sharing open sharing protocol (for providers)

This page gives an overview of how providers can use the Delta Sharing open sharing protocol to share data from your Unity Catalog-enabled Databricks workspace with any user on any computing platform, anywhere. If you are a data recipient (a user or group of users with whom data is being shared), see instead Access data shared with you using Delta Sharing (for recipients).

Who should use the Delta Sharing open sharing protocol?​

There are three ways to share data using Delta Sharing:

  1. The Databricks open sharing protocol, covered in this article, lets you share data that you manage in a Unity Catalog-enabled Databricks workspace with users on any computing platform.

    This approach uses the Delta Sharing server that is built into Databricks and is useful when you manage data using Unity Catalog and want to share it with users who don’t use Databricks or don’t have access to a Unity Catalog-enabled Databricks workspace. The integration with Unity Catalog on the provider side simplifies setup and governance for providers.

  2. A customer-managed implementation of the open-source Delta Sharing server lets you share from any platform to any platform, whether Databricks or not.

    See github.com/delta-io/delta-sharing.

  3. The Databricks-to-Databricks sharing protocol lets you share data from your Unity Catalog-enabled workspace with users who also have access to a Unity Catalog-enabled Databricks workspace.

    See Share data using the Delta Sharing Databricks-to-Databricks protocol (for providers).

For an introduction to Delta Sharing and more information about these three approaches, see What is Delta Sharing?.

Delta Sharing open sharing workflow​

This section provides a high-level overview of the open sharing workflow, with links to detailed documentation for each step.

In the Delta Sharing open sharing model:

  1. The data provider creates a recipient, which is a named object that represents a user or group of users that the data provider wants to share data with.

    When the data provider creates the recipient, the provider sets up authentication using either a long-lived bearer token or Open ID Connect (OIDC) federation. If the provider uses a bearer token, Databricks generates a credential file and an activation link that the data provider can send to the recipient to access the credential file. In the OIDC federation flow, the recipient's IdP manages authentication, based on a policy created by the provider.

    For details, see Create a recipient object for non-Databricks users using bearer tokens (open sharing) and Use Open ID Connect (OIDC) federation to enable authentication to Delta Sharing shares (open sharing).

  2. The data provider creates a share, which is a named object that contains a collection of tables registered in a Unity Catalog metastore in the provider’s account.

    For details, see Create and manage shares for Delta Sharing.

  3. The data provider grants the recipient access to the share.

    For details, see Manage access to Delta Sharing data shares (for providers).

  4. In the bearer token flow, the data provider sends the activation link to the recipient over a secure channel, along with instructions for using the activation link to download the credential file that the recipient will use to establish a secure connection with the data provider to receive the shared data.

    For details, see Get the activation link.

    In the OIDC federation flow, recipients authenticate through their IdP. See Use Open ID Connect (OIDC) federation to enable authentication to Delta Sharing shares (open sharing).

  5. In the bearer token flow, the data recipient follows the activation link to download the credential file, and then uses the credential file to access the shared data.

    Shared data is available to read only. Users can access data using their platform or tools of choice. For details, see Read data shared using Delta Sharing open sharing with bearer tokens (for recipients).

    In the OIDC federation flow, recipients authenticate through their IdP. See Use Open ID Connect (OIDC) federation to enable authentication to Delta Sharing shares (open sharing).

Provider-specific configurations​

Many providers have their own Delta Sharing networks for sharing. For specific sharing instructions, see, for example:

Provider setup and security considerations for open sharing​

Good token management is key to sharing data securely when you use the open sharing model:

  • Data providers on Databricks who intend to use open sharing when they provide shares must configure the default recipient token lifetime when they enable Delta Sharing for their Unity Catalog metastore. Databricks recommends that you configure tokens to expire. See Enable Delta Sharing on a metastore.
  • If you need to modify the default token lifetime, see Modify the recipient token lifetime.
  • Encourage recipients to manage their downloaded credential file securely.
  • For more information about token management and open sharing security, see Manage recipient tokens.
  • Open sharing is supported between cloud environment types, for example from AWS commercial clouds to AWS GovCloud or Azure China.

Data providers can provide additional security by assigning IP access lists to restrict recipient access to specific network locations. See Restrict Delta Sharing recipient access using IP access lists (open sharing).

Last updated on