Single Sign-On (SSO)
Database OAuth
Single Sign-On (SSO)
Database OAuth
For enhanced and more granular data security and privacy, Datafold supports running certain data worklfows such as data diffs through OAuth. In that mode, the query is executed on behalf of the user and with user’s database credentials, thereby ensuring full compliance with granular data access controls such as masking and per-object access permissions.
The diagram below illustrates how the authentication flow proceeds:
- Users authenticate using the configured OAuth provider.
- Users can then create diffs between data sets that their user can access using OAuth database permissions.
- During Continuous Integration (CI), Datafold executes diffs using a Service Account with the least privileges, thus masking sensitive/PII data.
- If a user needs to see sensitive/PII data from a CI diff, and they have permission via OAuth to do so, they can rerun the diff, and then Datafold will authenticate the user using OAuth database permissions. Then, the user will have access to the data based on these permissions.
This structure ensures that diffs are executed with the user’s database credentials with their configured roles and permissions. Data access permissions are thus fully managed by the database, and Datafold only passes through queries.
