Walk through the key questions to determine which authentication pattern fits your use case.
Is there a user logged in?
Think about who or what is making the request. Is it a human user interacting with the system, or an automated job/workflow?
If it's a scheduled job, CI/CD pipeline, or background process, there's no user identity.
→ Use Pattern 1: Service Principal
The service principal has fixed permissions that apply to every execution.
If a user is logged in, we need to ask:
Should each user see different data?
Do you need row-level security, user-specific filtering, or per-user audit trails?
If users need personalized data access:
→ Use Pattern 2: On-Behalf-Of-User (OBO)
Unity Catalog row filters use current_user() to show each user only their data.
Finally: Are you accessing external services?
If you need to call OpenAI, Salesforce, or other external APIs, you'll also need:
→ Add Pattern 3: Manual Credentials (via Databricks Secrets)
When: No user, automated jobs
When: User needs their own data
When: External APIs needed