Skip to content

Show Service Principal Display Name

Databricks Service Principals are provisioned in Ranger with the Application ID as the username, so they are identified only by a UUID. You can configure Privacera to show the Service Principal's display name alongside its Application ID, so you can tell which application a policy applies to, and which one performed a given action.

When enabled, a Service Principal is shown as its display name followed by its Application ID in brackets, display_name (application_id). For example, a Service Principal named Finance ETL is shown as Finance ETL (<application_id>).

This applies in three places:

Where Shown in
Resource Policy creation User selection
Access Audits User column
PolicySync Audits Actor column

Both the display name and the Application ID remain searchable, so existing filters continue to work.

This is display only

Policies are authored and enforced on the Application ID, and PolicySync grants and revokes in Unity Catalog continue to use the Application ID. Enabling this does not change access enforcement.

Prerequisites

Each Service Principal user must have the following, usually set by your user provisioning (for example, SCIM):

Setting Value
Attribute databricks_service_principal true
First Name The Service Principal's readable name
Attribute name.givenName The Service Principal's readable name

If databricks_service_principal is absent or not true, the user is shown unchanged.

Note

The display name in the Portal comes from the First Name. The display name in Access Audits and PolicySync Audits comes from the name.givenName attribute. Set both to the same value so that the same name is shown everywhere. If name.givenName is missing, the audits show only the Application ID.

Setup

  1. SSH to the instance where Privacera Manager is installed.

  2. Run the following command to open the .yml file to be edited.

    Bash
    1
    vi ~/privacera/privacera-manager/config/custom-vars/vars.portal.yml

  3. Add the following property.

    YAML
    1
    PORTAL_UC_PRINCIPAL_NAME_RESOLUTION_ENABLE: "true"
    Value Behavior
    "true" Shows the display name in the Portal and in the Databricks Unity Catalog connector's audits.
    "false" Shows the Application ID alone in both.
    "" Not managed by Privacera Manager. The Portal value is taken from Portal System Configuration, and the connector keeps it disabled.

    Set this property in the vars file

    Setting the property here keeps the Portal and the connector on the same value. When it is set, the Portal applies this value on every restart, so a change made in Portal System Configuration is overwritten. To change the setting, update this file and run the Privacera Manager update again.

  4. Once the property is configured, run the following commands to update your Privacera Manager platform instance:

    Step 1 - Setup which generates the helm charts. This step usually takes few minutes.

    Bash
    1
2
    cd ~/privacera/privacera-manager
./privacera-manager.sh setup
    Step 2 - Apply the Privacera Manager helm charts.
    Bash
    1
2
    cd ~/privacera/privacera-manager
./pm_with_helm.sh upgrade
    Step 3 - (Optional) Post-installation step which generates Plugin tar ball, updates Route 53 DNS and so on. This step is not required if you are updating only connector properties.

    Bash
    1
2
    cd ~/privacera/privacera-manager
./privacera-manager.sh post-install

Connector Behavior

Principal Shown as
Service Principal with both attributes display_name (application_id)
Service Principal with databricks_service_principal=true only Application ID alone
Service Principal whose display name equals its user name The name once, not repeated
Users, groups and roles without databricks_service_principal Unchanged
Principal present in Databricks but not in Ranger Unchanged

Existing audit records are not changed

The display name is applied when an audit record is written. Records created before the property was enabled continue to show the Application ID alone.

Newly added Service Principals

A Service Principal added to Ranger after the connector's last principal sync is shown by its Application ID alone until the next sync.