External OAuth integrations

Advanced

Posit Workbench supports external OAuth integrations with third-party data platforms, letting users securely access external resources using managed OAuth credentials. The Posit Team Native App lets you configure Databricks as an external OAuth provider.

Databricks OAuth integration

Workbench includes a native integration with Databricks, letting users access Databricks resources from their IDE sessions.

Databricks OAuth works alongside Snowflake managed credentials in Workbench, providing unified OAuth-based authentication across both platforms.

Prerequisites

Before configuring Databricks OAuth in Posit Team, complete the following:

  1. Create a Databricks OAuth app: In your Databricks workspace, create an OAuth application for Workbench integration.
  2. Configure the redirect URI: Set the OAuth redirect URI to match the callback URL displayed in Posit Team.
  3. Obtain credentials: Copy the client ID and, if your app uses one, the client secret from your Databricks OAuth app.

For detailed instructions on creating a Databricks OAuth app, see the Posit Workbench Administration Guide - Databricks Integration.

Configuration steps

Step 1: Open the Databricks integration form

From the Workbench Manage page, click OAuth Integrations to open the OAuth Integrations page. Click Add Integration and select Databricks: External OAuth.

The Add OAuth Integration dialog listing the Snowflake Native App Account and Databricks External OAuth integration types.

Add OAuth integration

Step 2: Note the OAuth callback URL

The Databricks form displays the OAuth redirect callback URL to configure in your Databricks OAuth app. Copy this URL for use in Databricks.

The Add OAuth Integration dialog showing the Databricks OAuth redirect callback URL and the Databricks configuration form.

OAuth callback URL
Important

Configure the OAuth callback URL exactly as shown in your Databricks OAuth application settings. Any mismatch causes authentication to fail.

Step 3: Enter the Databricks OAuth credentials

Fill out the Databricks form with the following information:

  • Connection Name: The name Workbench shows for this Databricks workspace (e.g., “default”, “production”, “aws-cluster”). The name can be up to 256 characters.
  • Workspace URL: The full URL of your Databricks workspace (e.g., https://dbc-a1b2c3d4-e5f6.cloud.databricks.com).
  • Client ID: The client ID from your Databricks OAuth application.
  • Client Secret: The client secret from your Databricks OAuth application. Azure Databricks and confidential OAuth apps on AWS require a client secret. Leave it blank for public OAuth apps.

Step 4: Save the configuration

Click Save Configuration. The integration appears in the Configured Integrations table, and the OAuth Integrations page shows Pending changes detected until the next Workbench upgrade.

Step 5: Upgrade Workbench

Navigate to the Workbench Manage page and click Upgrade to apply the changes. The upgrade process takes approximately 3-4 minutes.

Workbench Manage page showing the Upgrade button.

Workbench upgrade

Once the upgrade completes, Databricks OAuth is active and available to all Workbench users.

How users access Databricks

After the administrator configures Databricks OAuth, users can connect to Databricks from within their Workbench sessions.

Update the configuration

To update a Databricks OAuth integration:

  1. On the OAuth Integrations page, click the edit icon on the Databricks integration row.
  2. Modify the connection name, workspace URL, client ID, or client secret as needed.
  3. Click Save Configuration to save changes.
  4. Perform a Workbench service upgrade to apply the updated configuration.

The Edit OAuth Integration dialog showing the saved Databricks connection name, workspace URL, and client ID, a Client Secret field that masks the stored secret as asterisks, and the Clear secret checkbox.

Edit Databricks OAuth integration
Note

Posit Team does not display a stored client secret. Leave Client Secret blank to keep the stored secret, enter a value to replace it, or select Clear secret to remove it.

To remove a Databricks integration, click the delete icon on its row and confirm, then upgrade Workbench. See Delete an OAuth integration.

Multiple Databricks workspaces

To give users access to more than one Databricks workspace, add a Databricks integration for each workspace. Give each integration a different connection name so users can tell the workspaces apart.

Troubleshooting

OAuth callback URL mismatch

If users encounter authentication errors, verify that the OAuth callback URL configured in Databricks exactly matches the URL displayed in the Databricks form on the OAuth Integrations page.

Invalid connection name

Connection names cannot start or end with a space, and cannot contain line breaks or any of the characters ", ', `, \, #, or ;.

URL validation errors

The workspace URL must be a subdomain of a recognized Databricks domain: databricks.com, azuredatabricks.net, databricks.azure.us, or databricks.azure.cn. Contact Posit support if you use a custom domain that is not recognized.

Additional resources

For more information on Databricks integration with Workbench, see:

Back to top