databricks Platform · Updated Jun 15, 2026

OIDC Support for Iceberg Clients

Enhancing secure data sharing with OpenID Connect federation.

What it does

Databricks now supports OpenID Connect (OIDC) federation for sharing data with Iceberg clients, allowing them to read OpenSharing shares securely. This mechanism uses JSON Web Tokens (JWTs) issued by the recipient's identity provider (IdP) for authentication, enabling fine-grained access control and support for Multi-Factor Authentication (MFA). The OIDC federation allows data providers to manage access without needing to issue long-lived bearer tokens, thus enhancing security and compliance.

Why it matters

This update significantly improves the security and flexibility of data sharing across platforms, particularly for organizations using Iceberg clients like Snowflake or OSS Spark. By leveraging OIDC, businesses can enforce stricter access controls and reduce the risk associated with credential management, ultimately leading to enhanced data governance and compliance. It also streamlines the process for data providers, allowing them to share data securely with external partners or internal departments without compromising security.

Key capabilities

OIDC Federation Support

Enables authentication using JWTs from the recipient's IdP for secure data access.

Fine-Grained Access Control

Allows data providers to define precise access policies based on user roles and identities.

Multi-Factor Authentication

Supports MFA through the recipient's IdP, enhancing security during data access.

User-to-Machine and Machine-to-Machine Authentication

Facilitates both U2M and M2M authentication flows for diverse data-sharing scenarios.

Prerequisites

CREATE RECIPIENT privilege for the Unity Catalog metastore.

Recipient must be created in a Databricks workspace with the Unity Catalog attached.

Databricks Runtime 11.3 LTS or above is required for creating recipients via notebooks.

Recommended use cases

Sharing data with external partners using Iceberg clients.Internal data sharing within large organizations using a common IdP.Automated data access for background services via M2M authentication.User access to shared data through BI tools like Power BI or Tableau.

Architecture

Data Provider → OIDC Identity Provider → OpenSharing Service → Iceberg Client

Get started

Create Open OIDC Federation Recipient

In Databricks, navigate to Catalog and create a new recipient with OIDC Federation as the authentication method.

Configure OIDC Federation Policy

Add a policy specifying the issuer URL and claims for the recipient's IdP.

Grant Access to Shares

Use Catalog Explorer or SQL commands to grant the recipient access to the desired data shares.

Validate JWT Tokens

Ensure that the JWT tokens are validated against the recipient's configured federation policy.

Monitor Access and Security

Regularly review access logs and security policies to maintain compliance.

Key takeaway

The introduction of OIDC support for Iceberg clients enhances secure data sharing capabilities, allowing organizations to leverage existing identity management systems for improved governance.

2026-06-15-oidc-is-now-supported-for-sharing-to-iceberg-clients Generated by the Databricks Updates Agent · browse all updates