Configure JWT

To configure JWT, refer to the JWT Auth Configuration section in the Databricks Clusters - FGAC connector.

1. In PrivaceraCloud, navigate to Settings -> Applications.
2. On the Connected Applications screen, select S3.
3. On the screen, click the edit icon, and then click on Access Management -> ADVANCED tab.
4. Add the following properties:

   Properties

   1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19

   # static jwt configuration privacera.jwt.oauth.enable=true privacera.jwt.0.token.issuer=https://example.com/issuer privacera.jwt.0.token.publickey=<PUBLIC KEY> privacera.jwt.0.token.userKey=client_id privacera.jwt.0.token.groupKey=scope privacera.jwt.0.token.parserType=PING_IDENTITY # dynamic jwt configuration privacera.jwt.1.token.parserType=PING_IDENTITY privacera.jwt.1.token.userKey=client_id privacera.jwt.1.token.groupKey=scope privacera.jwt.1.token.issuer=https://example.com/issuer privacera.jwt.1.token.publickey.provider.url=<public_key_provider_url> privacera.jwt.1.token.publickey.provider.auth.type=basic privacera.jwt.1.token.publickey.provider.auth.username=your_username privacera.jwt.1.token.publickey.provider.auth.password=your_password privacera.jwt.1.token.publickey.provider.response.key=x5c privacera.jwt.1.token.publickey.provider.key.id=kid

5. Click the Test Connection button to verify the connection.
6. Once the connection is successful, click Save.

For a DataServer Runtime connector, configure JWT providers from the DataServer connector UI.

1. Open the connector and go to Access Control Configs → Connector Configs → Common Properties → JWT Authentication.
2. Turn on Enable JWT Authentication, then select Add JWT provider (add one provider per token issuer).
3. For each provider, fill in:
   • Issuer (required) — the expected iss claim, for example https://your-idp.example.com/issuer.
   • Parser Type (required) — the token parser that matches your IdP (for example, Ping Identity or Keycloak).
   • User Claim / Group Claim — the JWT claims that carry the username and groups (defaults client_id / scope).
   • Dynamic Public Key (JWKS) — the verification-key mode:
     • On (dynamic / JWKS) — set:
       • Public Key Provider URL — the JWKS endpoint.
       • Provider Auth Type — how the plugin authenticates to the provider:
         • Basic — set Provider Username and Provider Password.
         • None — no Authorization header; use this for a public endpoint.
       • Provider Response Key — default x5c.
       • Key ID Claim — default kid.
     • Off (static) — paste the static PEM in the Public Key field.
   • (Optional) Select Add property to set any additional provider-level property. Enter the key as token.<property>, without the privacera.jwt.<index>. prefix, for example token.subject, token.audience, or token.secret.
4. Select Save. The Runtime Manager redeploys the connector.