Skip to content

Configure Service Principal as User in Entra ID (AAD)

Privacera supports syncing Service Principals as users in Azure Active Directory (AAD). This section provides steps to configure Service Principal as a user in AAD.

Note

If Sync Service Principals as Users is enabled, AAD does not require that displayName of a Service Principal be a unique value. In this case a different attribute (such as appId) should be used as the Service Principal Username.

Note

The Application.Read.All permission is required to sync Service Principals. See Entra ID Prerequisites.

Setup

Go to the Privacera Manager host and navigate to the Privacera Manager installation directory:

Bash
1
2
cd ~/privacera/privacera-manager
vi config/custom-vars/vars.privacera-usersync.azuread.yml

Add or update the following variables:

Bash
1
2
3
4
5
6
#sync azure service principal to ranger user entity
AZURE_AD_SERVICEPRINCIPAL_ENABLED: "true"
#Properties to specify from which key to get values of username in case service principal is mapped to ranger user entity
# E.G displayName
AZURE_AD_SERVICEPRINCIPAL_USERNAME: "displayName"
AZURE_AD_SERVICEPRINCIPAL_FIRSTNAME: "displayName"

When using Databricks with user principals from Entra ID, ensure the following variables are set:

Bash
1
2
3
4
5
# Enable/Disable service principal flag attribute
AZURE_AD_SERVICEPRINCIPAL_FLAG_ATTRIBUTE_ENABLED: "true"
# Properties to specify from which key to set value of service principal flag attribute
# E.G databricks_service_principal
AZURE_AD_SERVICEPRINCIPAL_FLAG_ATTRIBUTE_KEY: "databricks_service_principal"

Restart Privacera Services

Bash
1
2
3
cd ~/privacera/privacera-manager
./privacera-manager.sh setup
./pm_with_helm.sh upgrade