> For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://help.sigmacomputing.com/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://help.sigmacomputing.com/_mcp/server. # Configure an OAuth application for Databricks > Configure OAuth for Databricks to authenticate users to Sigma, a Databricks connection, or both. You can use OAuth to authenticate to your Sigma organization, your Databricks connection in Sigma, or both using supported Databricks authorization methods. When using Databricks for OAuth with Sigma, you have 2 options: * Use Databricks OAuth for users (OAuth U2M). * Use a different IdP with Databricks OAuth token federation. If you do not want to use Databricks authorization methods to authenticate to Sigma, or want to connect to a different data platform, see [Configure a Sigma OAuth application](/docs/configure-a-sigma-oauth-application). This document covers the steps required to configure an OAuth application for Databricks. ## User requirements * In Databricks, you must be an account admin. See What are account admins? in the Databricks documentation. ## High-level overview To configure a custom OAuth application for Databricks, complete the following steps: * Step 1: [Create your custom OAuth application](#step-1-create-your-oauth-application) * Step 2: [Configure relevant OAuth options](#step-2-configure-relevant-oauth-options). * Step 3: [Determine the metadata URI](#step-3-determine-your-metadata-uri). ### Step 1: Create your OAuth application The steps to create an OAuth application differ depending on your IdP: * If you want to use Databricks as your IdP, see [Option 1: Create a custom OAuth application with Databricks OAuth for users (OAuth U2M)](#option-1-create-a-custom-oauth-application-with-databricks-oauth-for-service-principals). * If you want to use another platform as your IdP, see [Option 2: Configure a custom OAuth application using Databricks OAuth token federation](#option-2-configure-a-custom-oauth-application-using-databricks-oauth-token-federation). No matter which option you choose, record your client ID and client secret to use for your OAuth configuration in Sigma. #### Option 1: Create a custom OAuth application with Databricks OAuth for users To enable a custom OAuth application with Databricks OAuth for users (OAuth U2M), see the relevant Databricks documentation: * For Databricks on Azure, see Enable custom OAuth applications using the Azure Databricks UI in the Azure Databricks documentation. * For Databricks on AWS, see Enable custom OAuth applications using the Databricks UI in the Databricks documentation. * For Databricks on GCP, see Enable or disable partner OAuth applications in the Databricks documentation. After creating the application, proceed to [Step 2: Configure relevant OAuth options](#step-2-configure-relevant-oauth-options). #### Option 2: Configure a custom OAuth application using Databricks OAuth token federation If you want to use a different IdP but still use OAuth to authenticate to Databricks, you must use Databricks OAuth token federation. This option is only relevant if you plan to [connect to Databricks using OAuth](/docs/connect-to-databricks-oauth). Before you can set up token federation, you must have the following information: | Prerequisite information | Details | | ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Issuer URL** | | | **Audiences** | Found in the authorization server's access token payload. | | **Subject claim** | Your Databricks user identifier, such as the email address associated with your Databricks account. | For more information, see the Databricks documentation on Account-wide token federation. To configure Databricks OAuth token federation with a custom OAuth application, complete steps 1–4 and step 6 in [Configure a Sigma OAuth application](/docs/configure-a-sigma-oauth-application), then continue to [Step 2: Configure relevant OAuth options](#step-2-configure-relevant-oauth-options). ### Step 2: Configure relevant OAuth options To use the OAuth configuration with Sigma, configure the following options as follows: * **Redirect URLs**: Set a redirect URL that matches where your Sigma organization is hosted: * If you set up connection-level OAuth, the redirect URL is listed in the **OAuth features** section in the **Redirect URI** field. * If you plan to set up organization-level OAuth, construct a redirect URL using the following format: `https://{{baseUrl}}/v2/oauth/1/authcode`. Manually update the URL to use the `{{baseUrl}}` specific to where your Sigma organization is hosted. The `{{baseUrl}}` value is listed in the API endpoint column of the [Supported cloud platforms and regions](/docs/region-warehouse-and-feature-support#supported-cloud-platforms-and-regions) table. For example, `https://api.sigmacomputing.com/api/v2/oauth/1/authcode` for a Sigma organization hosted on GCP-US. * **Access scopes**: When prompted to select an access scope, select **All APIs**. If you use Microsoft Entra ID as your IdP, you must also create a custom `databricks` scope. * **Client secret**: Enable the option to generate a client secret, as Sigma requires this for secure connection. * **Refresh token time-to-live (TTL)**: This value determines how long users can be signed in to Sigma before being prompted to sign in again. Set a value consistent with your organization's security policies. To avoid frequent interruptions for your users, Sigma recommends a TTL value of 90 days. To avoid disruption to scheduled exports, do not set a value lower than 7 days. After you configure the options in this step, proceed to [Step 3: Determine your metadata URI](#step-3-determine-your-metadata-uri). ### Step 3: Determine your metadata URI Determine the metadata URI that Sigma requires to complete the OAuth configuration. The metadata URI includes the unique ID for your Databricks account, and is required to complete your OAuth configuration in Sigma. Store this value for later use when creating your connection in Sigma. The process to determine your metadata URI depends on your chosen IdP: * If you are using Databricks as your IdP, see [Determine your metadata URI for Databricks OAuth for users](#determine-your-metadata-uri-for-databricks-oauth-for-users). * If you are using another IdP, see [Determine your metadata URI for your external IdP](#determine-your-metadata-uri-for-your-external-idp). #### Determine your metadata URI for Databricks OAuth for users If you use Databricks OAuth for users (OAuth U2M), construct your metadata URI using your Databricks account ID based on your environment and other configurations: 1. Retrieve your Databricks account ID. For instructions, see Locate your account ID in the Databricks documentation. 2. Construct your metadata URI based on your setup: * For Databricks on Azure: `https://accounts.azuredatabricks.net/oidc/accounts//.well-known/openid-configuration` * For Databricks on AWS, if your organization uses workspace-level legacy SSO, and has unified login enabled: `https:///oidc/.well-known/openid-configuration` * For Databricks on AWS and your organization does not use workspace-level legacy SSO, or does not have unified login enabled: `https://accounts.cloud.databricks.com/oidc/accounts//.well-known/openid-configuration` * For Databricks on GCP: `https://accounts.gcp.databricks.com/oidc/accounts//.well-known/openid-configuration` #### Determine your metadata URI for your external IdP The process to determine your metadata URI is specific to your IdP. Check the documentation for your IdP for guidance. For more information on setting up OAuth for specific IdPs, see the Sigma Community post on Guidelines For Configuring OAuth and SAML Authentication. ## Related resources * [About using OAuth with Sigma](/docs/configure-oauth) * [Configure OAuth authentication for your Sigma organization](/docs/configure-oauth-authentication-for-your-sigma-organization) * [Connect to Databricks with OAuth](/docs/connect-to-databricks-oauth)