Databricks中能否将Azure AD用户映射至多个组以管理RLS与CLS？

前置条件 #

• 具备Databricks工作区管理员或用户组管理权限
• Azure AD目标用户已同步至Databricks（邮箱匹配）
• 已在Databricks中创建好需要关联的业务组

操作步骤 #

1. 通过邮箱获取Databricks用户ID #

使用Databricks SCIM API查询目标用户的唯一ID：

curl -n -X GET 'https://<databricks-workspace-url>/api/2.0/scim/v2/Users?filter=emails%20eq%20%22user@domain.com%22' \
-H 'Authorization: Bearer <your-access-token>'

从返回的JSON结果中提取Resources[0].id值，即为用户的Databricks ID。

2. 批量将用户添加至业务组 #

方式1：单组手动API调用

先查询目标业务组的ID：

curl -n -X GET 'https://<databricks-workspace-url>/api/2.0/scim/v2/Groups?filter=displayName%20eq%20%22group-name%22' \
-H 'Authorization: Bearer <your-access-token>'

再执行添加用户的PATCH请求：

curl -n -X PATCH 'https://<databricks-workspace-url>/api/2.0/scim/v2/Groups/<group-id>' \
-H 'Authorization: Bearer <your-access-token>' \
-H 'Content-Type: application/json' \
-d '{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
  "Operations": [
    {
      "op": "add",
      "path": "members",
      "value": [{"value": "<user-id>"}]
    }
  ]
}'

方式2：Python脚本批量处理

适合同时添加到多组的场景：

import requests

workspace_url = "https://<databricks-workspace-url>"
token = "<your-access-token>"
headers = {"Authorization": f"Bearer {token}", "Content-Type": "application/json"}

# 配置目标信息
user_email = "user@domain.com"
target_groups = ["sales-team", "finance-team", "operations-team"]

# 获取用户ID
user_res = requests.get(
    f"{workspace_url}/api/2.0/scim/v2/Users?filter=emails eq '{user_email}'",
    headers=headers
)
user_id = user_res.json()["Resources"][0]["id"]

# 遍历组完成添加
for group_name in target_groups:
    # 获取组ID
    group_res = requests.get(
        f"{workspace_url}/api/2.0/scim/v2/Groups?filter=displayName eq '{group_name}'",
        headers=headers
    )
    group_id = group_res.json()["Resources"][0]["id"]
    
    # 执行添加操作
    patch_data = {
        "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
        "Operations": [{"op": "add", "path": "members", "value": [{"value": user_id}]}]
    }
    requests.patch(
        f"{workspace_url}/api/2.0/scim/v2/Groups/{group_id}",
        json=patch_data,
        headers=headers
    )
    print(f"用户 {user_email} 已成功加入组 {group_name}")

3. 验证用户组归属 #

通过API或Databricks UI确认用户已加入目标组：

curl -n -X GET 'https://<databricks-workspace-url>/api/2.0/scim/v2/Users/<user-id>' \
-H 'Authorization: Bearer <your-access-token>'

查看返回结果中的groups字段，确认所有目标组已出现在列表中。

RLS/CLS关联管理 #

完成用户组映射后，直接以业务组为权限主体配置安全策略：

• 行级安全（RLS）示例：

CREATE OR REPLACE ROW FILTER POLICY sales_region_filter ON sales_db.sales_data
FOR SELECT USING (region IN (SELECT allowed_region FROM security.allowed_regions WHERE group_name = 'sales-team'))
TO `sales-team`;

• 列级安全（CLS）示例：

CREATE OR REPLACE COLUMN MASK POLICY salary_mask ON hr_db.employees
FOR (salary DOUBLE)
USING (CASE WHEN is_member('hr-team') THEN salary ELSE '***' END)
TO `hr-team`, `finance-team`;

内容的提问来源于stack exchange，提问作者kaa