Delta Sharing - Info about Share Recipient

[data-grassroots]

What information do you know about a share recipient when they access a table shared to them via Delta Sharing?

Wondering if we might be able to utilize something along the lines of is_member, is_account_group_member, session_user, etc for ROW and COL level filtering before we get too far into looking at Delta Sharing.

Thank you

[Kaniz · Accepted solution]

Hi @data-grassroots,

Delta Sharing is an open protocol developed by Databricks for secure data sharing with other organiz...¹. When a table is shared via Delta Sharing, the recipient is represented by a named object that signif...².

However, Delta Sharing does not inherently provide information about the share recipient when they access a shared table. The protocol focuses on securely sharing access to part of a cloud dataset³. It doesn’t seem to have built-in support for utilizing something like is_member, is_account_group_member, session_user, etc, for row and column-level filtering.

That said, Databricks does offer features for filtering sensitive table data using row filters and c...⁴. Row filters allow you to apply a filter to a table so that subsequent queries only return rows for w...⁴. This is implemented as a SQL user-defined function (UDF). You first write a SQL UDF to define the filter policy and then apply it to a table with an ALTER TAB...⁴.

Please note that these features are specific to Databricks and may not be directly applicable to Delta Sharing. If you need to implement row and column-level filtering in Delta Sharing, you might need to build a custom solution that integrates with your identity provider or user management system.

[data-grassroots]

Thanks Kaniz.

I'll look a little deeper. The idea was to utilize UDFs to limit access a larger dataset. If you're from Org A, you get to see this subset, if you're from Org B, you get to see this other subset, if you're from Org C, you get to see the entire dataset.

That sort of thing.

[data-grassroots]

Now that I'm looking closer at the share credentials and the recipient entity you would really need a way to know the bearer token and relate that back to various recipient properties - databricks.name and any custom recipient property tags you may have associated with than recipient.