Show all privileges granted to principal

[alm]

Given the name of a principal in Databricks (I'm using account-level groups) is there an easy way to query or in other way obtain all privileges granted to this principal?

I know I can obtain the information by querying in several of the system.information_schema and will do that if there isn't a simpler option. It just seems like information that should be readily accessible?

[Kaniz]

Hi @alm, In Databricks, you can manage service principals to handle automated tools, jobs, and applications. These service principals provide API-only access to Databricks resources, enhancing security compared to using regular users or groups.

Let’s dive into the details:

1. What is a Service Principal?

   • A service principal is an identity created in Databricks specifically for use with automated tools, scripts, and applications.
   • It allows API-only access to Databricks resources.
   • Similar to regular users, you can grant and restrict a service principal’s access to resources.
   • Unlike regular users, a service principal cannot access the Databricks UI.

2. Managing Service Principals:

   • Account Admins, Workspace Admins, or users with specific roles on a service principal can manage them.
   • Here are some actions you can take with service principals:
     • Assign Roles: Give a service principal account admin and workspace admin roles.
     • Data Access: Provide access to data at the account level using Unity Catalog or at the workspace level.
     • Group Membership: Add a service principal to groups (both at the account and workspace levels).
     • Job Execution: Users can run jobs as the service principal, ensuring job stability even if users leave the organization or groups are modified.

3. Identity Federation (Recommended):

   • Databricks recommends enabling identity federation for your workspaces.
   • Identity federation simplifies administration and data governance.
   • It allows you to configure service principals in the account console and assign them access to specific workspaces.

Remember, if your account was created after November 8, 2023, identity federation is enabled by defa...¹. So, managing service principals should be straightforward! 🚀

[alm]

This dosn't really address my problem.

I worked around it and found another solution. It just surprised me that this information isn't readily available  

[Ivan_Donev]

How did you solve your problem? By going through the information_schema or system tables? Or something else?

[alm]

Yes, I used a combination of the information_schema.{object_type}_privileges tables. As the naming varies, i.e. catalog_name in schema_privileges but table_catalog in table_privileges, it's a bit cumbersome but definitely possible.