topic Re: Azure Databricks Enterprise Application User Impersonation Token Group Claims Issue in Get Started Discussions

Azure Databricks Enterprise Application User Impersonation Token Group Claims Issue

ahsan_aj — Thu, 26 Sep 2024 16:10:20 GMT

Hi all,

I am using the Azure Databricks Microsoft Managed Enterprise Application scope (2ff814a6-3304-4ab8-85cb-cd0e6f879c1d/user_impersonation) to fetch an access token on behalf of a user. The authentication process is successful; however, the access token includes group claims. For users who are part of many Azure AD groups, the token becomes quite large because it lists all the groups in the claims. How can I modify my request for the token to exclude group claims from the access token?

I am using the React MSAL library, and here’s a sample of the code I am working with:

export const getDatabricksToken = async () => { const account = msalInstance.getActiveAccount(); const response = await msalInstance.acquireTokenSilent({ scopes: ["2ff814a6-3304-4ab8-85cb-cd0e6f879c1d/user_impersonation"], account: account, }) return response.accessToken };

Re: Azure Databricks Enterprise Application User Impersonation Token Group Claims Issue

skraszki — Thu, 09 Jan 2025 19:14:10 GMT

Hi, did you find an answer for it?

Re: Azure Databricks Enterprise Application User Impersonation Token Group Claims Issue

Alberto_Umana — Thu, 09 Jan 2025 19:55:07 GMT

Hi @ahsan_aj,

You can modify your token request by adding a claims parameter

const claimsRequest = {

"access_token": {

"groups": null

}

https://learn.microsoft.com/en-us/security/zero-trust/develop/configure-tokens-group-claims-app-roles

Re: Azure Databricks Enterprise Application User Impersonation Token Group Claims Issue

ahsan_aj — Fri, 10 Jan 2025 05:39:01 GMT

I got in touch with Microsoft support and they mentioned it is not possible as the Azure Databricks app registration is managed by Databricks and changing the manifest to exclude group claims on that application is not possible and it impacts all users.

Re: Azure Databricks Enterprise Application User Impersonation Token Group Claims Issue

ahsan_aj — Fri, 10 Jan 2025 05:39:15 GMT

Let me try this and get back to you.

Re: Azure Databricks Enterprise Application User Impersonation Token Group Claims Issue

ahsan_aj — Fri, 10 Jan 2025 05:54:41 GMT

I tried it like this, however it still adds group claims in the access token: