OAuth app registrations

An app registration stores the OAuth details for an identity provider, including the client ID, client secret, and scopes, so that fabric connections in Prophecy can authenticate through that provider. Cluster admins create app registrations after the corresponding OAuth application exists on the provider side. This page covers how to create the provider-side OAuth application for each supported provider, add the app registration in Prophecy, and control which registration a fabric uses.

Available for the Express and Enterprise Editions only.

Prerequisites

Before you configure OAuth in Prophecy, ensure you have:

Cluster admin access to Prophecy.
Access to an admin for your identity provider, such as a Databricks account admin, a Snowflake account admin, or an ADFS admin.
An OAuth application created with your identity provider. See Create provider-side OAuth applications.
The client ID from your provider’s OAuth application.

Supported providers

Prophecy supports OAuth authentication with the following providers:

Databricks: Authenticate with Databricks workspaces.
Google: Authenticate with Google Cloud services.
ID Anywhere: Authenticate with custom identity providers.
ID Anywhere (Snowflake): Authenticate with Snowflake through an ADFS/ID Anywhere identity provider instead of Snowflake’s native OAuth.
Snowflake: Authenticate with Snowflake using Snowflake’s native OAuth.

Create provider-side OAuth applications

Before you add an app registration in Prophecy, create the corresponding OAuth application with your provider.

Databricks

A Databricks account admin completes the following steps once for your Prophecy deployment:

On Databricks, navigate to Account Settings > App connections in your account console.
Create a new App connection for Prophecy. Set access scopes to ALL APIs, and add the following redirect URLs:

https://<your_prophecy_url>/api/databricks/oauthredirect
 https://<your_prophecy_url>/metadata/oauthCallback

This process generates Databricks OAuth Application fields on the Prophecy side.
Under Client ID, copy the OAuth client ID for the application and share it with your Prophecy cluster admin.
Under Client secret, select Generate a client secret and share it with your Prophecy cluster admin.
Click Save.

Google Cloud

Create an OAuth 2.0 client in Google Cloud Console:

Sign in to Google Cloud Console.
Select your project.
Go to APIs & Services > Credentials.
Click Create Credentials > OAuth client ID.
If prompted, configure the OAuth consent screen.
Select the application type.
Add the following redirect URI:


https://<your_prophecy_url>/metadata/oauthCallback

Save the generated client ID and secret for use in Prophecy.

For detailed instructions, see Setting up OAuth 2.0 in the Google Cloud documentation.

ID Anywhere

For custom identity providers, consult your provider’s documentation to:

Create an OAuth 2.0 application or client.
Configure the authorization endpoint.
Define the required scopes.
Generate client credentials.
Set up redirect URIs that point to your Prophecy instance.

ID Anywhere (Snowflake)

Use this provider when you want a Snowflake fabric to authenticate through an ADFS/ID Anywhere identity provider instead of Snowflake’s native OAuth. The registration can point at the same ADFS instance as a Databricks ID Anywhere registration or a different one. Each registration uses the Authorization Endpoint you enter on it, and registrations don’t share endpoints. Before you add the app registration in Prophecy:

Register the relying party (or equivalent) with your ADFS admin and note its ID. You enter this ID as the registration’s Default Scope.
Add the same relying-party ID to Snowflake’s EXTERNAL_OAUTH_AUDIENCE_LIST for the security integration.
Set Snowflake’s EXTERNAL_OAUTH_TOKEN_USER_MAPPING_CLAIM to the claim your ADFS access token uses to carry the Snowflake username, such as email.

Prophecy reads the same claim from the access token to determine the session user. If the claim is missing or doesn’t match the Snowflake configuration, login fails with an error that identifies the claim mismatch.

Snowflake

Use this provider when you want Snowflake fabrics and connections to authenticate with Snowflake’s native OAuth. A Snowflake account admin creates a custom OAuth security integration for Prophecy:

CREATE SECURITY INTEGRATION prophecy_oauth
TYPE = OAUTH
ENABLED = TRUE
OAUTH_CLIENT = CUSTOM
OAUTH_CLIENT_TYPE = 'CONFIDENTIAL'
OAUTH_REDIRECT_URI = 'https://<your_prophecy_url>/metadata/oauthCallback'
OAUTH_ISSUE_REFRESH_TOKENS = TRUE;

Then retrieve the client ID and client secret for the integration:

SELECT SYSTEM$SHOW_OAUTH_CLIENT_SECRETS('PROPHECY_OAUTH');

Use OAUTH_CLIENT_ID as the App Client ID and OAUTH_CLIENT_SECRET as the App Client Secret in Prophecy.

Create an app registration

To add a new OAuth app registration:

Sign in to Prophecy as a cluster admin.
In the navigation menu, go to Settings > Admin.
Select the Security tab.
Click Add App Registration.

Configure the registration settings:

Field	Description	Required
Provider	Select your identity provider.	Yes
Default for Provider	When enabled, this registration becomes the default OAuth configuration for fabrics for the selected provider. The default is always used for Spark fabrics and cannot be changed at the fabric level.	No
Name	A descriptive name to identify this registration. Useful when you manage multiple registrations for the same provider.	Yes
App Client ID	The client ID from your OAuth application.	Yes
App Client Secret	The client secret from your OAuth application.	Google, Snowflake
Token Lifetime (minutes)	Token lifetime in minutes. Overrides the default token lifetime set by your provider.	Yes
Authorization Endpoint	The authorization URL for your identity provider.	ID Anywhere, ID Anywhere (Snowflake)
Default Scope	Space-separated list of OAuth scopes. Optional for Databricks, Google, and Snowflake to override default scopes.	ID Anywhere, ID Anywhere (Snowflake)

Click Save.

Default and custom scopes

Default scopes vary by provider. To override them, enter a space-separated list in Default Scope.

Provider	Default scopes	Scope reference
Databricks	`all-apis offline_access profile email openid`	Custom app integration scopes
Google	`https://www.googleapis.com/auth/bigquery`	OAuth 2.0 Scopes for Google APIs
ID Anywhere	None (must specify manually)	Consult your provider’s documentation.
ID Anywhere (Snowflake)	None (must specify manually)	See ID Anywhere (Snowflake).
Snowflake	None	Snowflake OAuth scopes

App registration selection

You can create more than one app registration for the same provider. How a fabric chooses among them depends on the fabric type. In Prophecy fabrics, you select the app registration from a dropdown in the fabric connection settings and can switch between registrations. For example, if you configure a Databricks connection and have multiple Databricks app registrations, you choose which one the connection uses. Spark fabrics always use the provider’s default app registration, and you can’t change it at the fabric level. To control which registration a Spark fabric uses, enable Default for Provider on that registration.

Platform

Setup

Management

Help and resources

Prerequisites

Supported providers

Create provider-side OAuth applications

Databricks

Google Cloud

ID Anywhere

ID Anywhere (Snowflake)

Snowflake

Create an app registration

Default and custom scopes

App registration selection

​Prerequisites

​Supported providers

​Create provider-side OAuth applications

​Databricks

​Google Cloud

​ID Anywhere

​ID Anywhere (Snowflake)

​Snowflake

​Create an app registration

​Default and custom scopes

​App registration selection

Prerequisites

Supported providers

Create provider-side OAuth applications

Databricks

Google Cloud

ID Anywhere

ID Anywhere (Snowflake)

Snowflake

Create an app registration

Default and custom scopes

App registration selection