BerriAI / litellm
github.com·3d ago
Developer Tools
Databricks Blog·5d ago·5 min read
Now GA: Building permission-aware Databricks Apps with on-behalf-of-user authorization
TL;DR
Databricks has launched on-behalf-of-user (OBO) authorization for its Apps, enabling developers to create personalized, permission-aware applications without duplicating data governance rules. This feature enhances user experience while maintaining strict data access controls.
✦ Why It Matters
Implement OBO authorization in your Databricks Apps to enhance user-specific data access while ensuring compliance with governance rules.
Key Takeaways
- Utilize OBO authorization for personalized app experiences.
- Define API scopes to limit app capabilities on user behalf.
- Combine app and user authorization models for flexibility.
- Ensure compliance with data governance in app design.
How It Works
OBO authorization allows apps to act under the signed-in user's identity, enforcing their existing data permissions through Unity Catalog. When a user accesses an app, their access token is forwarded, enabling the app to execute queries based on their permissions.
This mechanism ensures that users only see data they are authorized to access, while the app maintains a separate identity for its own operations.