Step 2: Set Up Databricks Authentication

CAS connects to Databricks using a service principal with OAuth secrets. You will create a service principal, generate OAuth secrets, and configure workspace access.

1. In the Databricks Account Console, navigate to User management > Service principals.
2. Click Add service principal.
3. Enter a display name for the service principal (e.g., TD-CAS-Service).
4. Click Add service principal to create it.
5. Note the Application ID assigned to the service principal.

1. In the Databricks Account Console, navigate to User management > Service principals.
2. Select the service principal you created in the previous step.
3. Go to Credentials & secrets.
4. Click Generate secret to create it.
5. Note the Client ID and Client Secret values. You will need them in Step 3: Configure Databricks Authentication in Integration Hub.

1. In your Databricks workspace, go to Settings > Workspace admin > Identity and access > Service principals.
2. Click Add service principal.
3. Search for and select the service principal you created.
4. Click Add to grant workspace access.

If your Unity Catalog has fine-grained access controls, ensure the service principal has the necessary permissions:

1. Navigate to Catalog in the Databricks workspace sidebar.
2. Select the target catalog (e.g., cas_demo_east1).
3. Click Permissions > Grant.
4. Add the service principal as a principal.
5. Select CREATE TABLE and the Data Reader privilege preset, which grants:
   • Prerequisite: USE CATALOG, USE SCHEMA
   • Metadata: BROWSE
   • Read: EXECUTE, SELECT

The service principal needs to have CREATE TABLE to create a temporary table for activations.

If your Databricks workspace uses IP access lists, add Treasure AI's export IP addresses to the allow list. Use the Databricks CLI:

databricks ip-access-lists create --json '{
  "label": "TreasureAI",
  "list_type": "ALLOW",
  "ip_addresses": [
    "<TD_IP_1>",
    "<TD_IP_2>"
  ]
}'

Composable Audience Studio also supports Personal Access Tokens (PATs) for Databricks access.

A workspace admin must create the initial PAT on behalf of the service principal using the Databricks CLI:

1. Set up authentication for the Databricks CLI if not already configured.
2. Get the Application ID of the service principal:
   • Click your username in the top bar, then click Settings.
   • Under Workspace admin, click Identity and access > Manage (next to Service principals).
   • Click the service principal name to open its settings page.
   • On the Configurations tab, note the Application Id value.
3. Run the following command to generate the access token:

databricks token-management create-obo-token \
  <application-id> \
  --lifetime-seconds 86400 \
  --profile <admin-profile>

Once the service principal has its first PAT, it can create additional tokens for itself:

databricks tokens create --lifetime-seconds 86400 --profile <sp-pat-profile>