topic Re: on-behalf-of token creation (for SPN) in Data Engineering

on-behalf-of token creation (for SPN)

clapton79 — Tue, 06 Sep 2022 12:55:02 GMT

I am trying to create an on-behalf-token for and SPN on my Azure Databricks Premium instance. The response is a FEATURE_DISABLED error message ("On-behalf-of token creation for service principals is not enabled for this workspace"). How do I turn on this feature?

Re: on-behalf-of token creation (for SPN)

User16752245772 — Tue, 20 Sep 2022 06:08:06 GMT

HI @Laszlo Katai-Pal

You need to provide CAN_USE permission to the service principal in the token manage permission, you can see this option in : Admin->workspace setting

Once you provide this permission to your SP , you can create token on behalf of SP

Re: on-behalf-of token creation (for SPN)

gklassen — Thu, 27 Jul 2023 18:58:39 GMT

Hi there,

I've performed the above steps and am trying to create an OBO token via CLI 0.2 using "databricks

token-management create-obo-token <app-id-here> 3600"

but I continue to get the error message: "On-behalf-of token creation for service principals is not enabled for this workspace"

Is there anything else that's a prerequisite to allowing these tokens to be created? The SP has been added to a group which has been added to the workspace, and given CAN_USE on tokens via the admin screen. Do the SPs need admin rights on the workspace?

Re: on-behalf-of token creation (for SPN)

Chris_Shehu — Thu, 27 Jul 2023 19:42:02 GMT

My understanding is that Microsoft has this disabled this but it's not very clear in any of the MS documentation. Our MS rep had to do some digging to get to that conclusion.

Re: on-behalf-of token creation (for SPN)

chaitanyak — Thu, 21 Sep 2023 14:26:45 GMT

gklassen and Chris_Shehu : Any further luck on this issue. Is it resolved.. ? I am also facing the same issue..

Re: on-behalf-of token creation (for SPN)

alexott — Mon, 23 Oct 2023 14:43:03 GMT

There is no On-behalf-of token on Azure - just generate an AAD token for the Service Principal and use it to create PAT (make sure that SP has permission to use PATs).

The easiest way of doing it is to use the new Databricks CLI that supports unified authentication - just set the correct environment variables or define all parameters as a profile in the configuration file, and use "databricks tokens create" command to generate tokens. Something like this:

export DATABRICKS_HOST=https://adb-....17.azuredatabricks.net
export ARM_CLIENT_SECRET=<sp_secret>
export ARM_CLIENT_ID=<application_id>
export ARM_TENANT_ID=<tenant_id>
databricks tokens create --lifetime-seconds 30 --comment "test"

Here is a reference implementation for the Databricks Terraform provider.