com.databricks.sdk.service.sharing

Class RecipientFederationPoliciesAPI

java.lang.Object

com.databricks.sdk.service.sharing.RecipientFederationPoliciesAPI

@Generated
public class RecipientFederationPoliciesAPI
extends Object

The Recipient Federation Policies APIs are only applicable in the open sharing model where the recipient object has the authentication type of `OIDC_RECIPIENT`, enabling data sharing from Databricks to non-Databricks recipients. OIDC Token Federation enables secure, secret-less authentication for accessing Delta Sharing servers. Users and applications authenticate using short-lived OIDC tokens issued by their own Identity Provider (IdP), such as Azure Entra ID or Okta, without the need for managing static credentials or client secrets. A federation policy defines how non-Databricks recipients authenticate using OIDC tokens. It validates the OIDC claims in federated tokens and is set at the recipient level. The caller must be the owner of the recipient to create or manage a federation policy. Federation policies support the following scenarios: - User-to-Machine (U2M) flow: A user accesses Delta Shares using their own identity, such as connecting through PowerBI Delta Sharing Client. - Machine-to-Machine (M2M) flow: An application accesses Delta Shares using its own identity, typically for automation tasks like nightly jobs through Python Delta Sharing Client. OIDC Token Federation enables fine-grained access control, supports Multi-Factor Authentication (MFA), and enhances security by minimizing the risk of credential leakage through the use of short-lived, expiring tokens. It is designed for strong identity governance, secure cross-platform data sharing, and reduced operational overhead for credential management.

For more information, see https://www.databricks.com/blog/announcing-oidc-token-federation-enhanced-delta-sharing-security and https://docs.databricks.com/en/delta-sharing/create-recipient-oidc-fed

Constructor Summary

Constructors

Constructor and Description
RecipientFederationPoliciesAPI(ApiClient apiClient) Regular-use constructor
RecipientFederationPoliciesAPI(RecipientFederationPoliciesService mock) Constructor for mocks

Method Summary

Modifier and Type	Method and Description
FederationPolicy	create(CreateFederationPolicyRequest request) Create a federation policy for an OIDC_FEDERATION recipient for sharing data from Databricks to non-Databricks recipients.
void	delete(DeleteFederationPolicyRequest request) Deletes an existing federation policy for an OIDC_FEDERATION recipient.
void	delete(String recipientName, String name)
FederationPolicy	getFederationPolicy(GetFederationPolicyRequest request) Reads an existing federation policy for an OIDC_FEDERATION recipient for sharing data from Databricks to non-Databricks recipients.
FederationPolicy	getFederationPolicy(String recipientName, String name)
RecipientFederationPoliciesService	impl()
Iterable<FederationPolicy>	list(ListFederationPoliciesRequest request) Lists federation policies for an OIDC_FEDERATION recipient for sharing data from Databricks to non-Databricks recipients.
Iterable<FederationPolicy>	list(String recipientName)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

RecipientFederationPoliciesAPI

public RecipientFederationPoliciesAPI(ApiClient apiClient)

Regular-use constructor

RecipientFederationPoliciesAPI

public RecipientFederationPoliciesAPI(RecipientFederationPoliciesService mock)

Constructor for mocks

Method Detail

create

public FederationPolicy create(CreateFederationPolicyRequest request)

Create a federation policy for an OIDC_FEDERATION recipient for sharing data from Databricks to non-Databricks recipients. The caller must be the owner of the recipient. When sharing data from Databricks to non-Databricks clients, you can define a federation policy to authenticate non-Databricks recipients. The federation policy validates OIDC claims in federated tokens and is defined at the recipient level. This enables secretless sharing clients to authenticate using OIDC tokens.

Supported scenarios for federation policies: 1. **User-to-Machine (U2M) flow** (e.g., PowerBI): A user accesses a resource using their own identity. 2. **Machine-to-Machine (M2M) flow** (e.g., OAuth App): An OAuth App accesses a resource using its own identity, typically for tasks like running nightly jobs.

For an overview, refer to: - Blog post: Overview of feature: https://www.databricks.com/blog/announcing-oidc-token-federation-enhanced-delta-sharing-security

For detailed configuration guides based on your use case: - Creating a Federation Policy as a provider: https://docs.databricks.com/en/delta-sharing/create-recipient-oidc-fed - Configuration and usage for Machine-to-Machine (M2M) applications (e.g., Python Delta Sharing Client): https://docs.databricks.com/aws/en/delta-sharing/sharing-over-oidc-m2m - Configuration and usage for User-to-Machine (U2M) applications (e.g., PowerBI): https://docs.databricks.com/aws/en/delta-sharing/sharing-over-oidc-u2m

delete

public void delete(String recipientName,
                   String name)

delete

public void delete(DeleteFederationPolicyRequest request)

Deletes an existing federation policy for an OIDC_FEDERATION recipient. The caller must be the owner of the recipient.

getFederationPolicy

public FederationPolicy getFederationPolicy(String recipientName,
                                            String name)

getFederationPolicy

public FederationPolicy getFederationPolicy(GetFederationPolicyRequest request)

Reads an existing federation policy for an OIDC_FEDERATION recipient for sharing data from Databricks to non-Databricks recipients. The caller must have read access to the recipient.

list

public Iterable<FederationPolicy> list(String recipientName)

list

public Iterable<FederationPolicy> list(ListFederationPoliciesRequest request)

Lists federation policies for an OIDC_FEDERATION recipient for sharing data from Databricks to non-Databricks recipients. The caller must have read access to the recipient.

impl

public RecipientFederationPoliciesService impl()