Honeycomb Maps Docs

Appearance

Authenticating to data warehouses ​

Authentication (AuthN) is the process of proving identity to a system. When connecting Honeycomb Maps to a data warehouse like Snowflake or Databricks, authentication lets Honeycomb Maps access data securely.

There are different ways to authenticate to data warehouses. They can be broadly grouped into two categories - user-based and user-independent.

User-based authentication methods connect to the data warehouse with a specific user identity. This is advantageous when you want to restrict access to data based on who is using the application. For example, your organization may have RBAC (role-based access policies) which allow salespeople to only see prospects in their sales territory.

User-independent authentication methods connect to the data warehouse as generic account that is not tied to a specific human user. This may be preferable if you don't need user identity, or you want to share Honeycomb Maps in a context where the user isn't known (for example, a public map).

Authenticating to Snowflake ​

Snowflake OAuth - Snowflake OAuth Setup Guide ​

In this model, Snowflake serves as the Identity Provider (IdP) for an OAuth 2.0 Authentication Code Flow process. Honeycomb Maps acts as the client.

The user is redirected to a Snowflake window (the 'Consent Screen'), asked to sign in if they aren't already, and then is asked to allow Honeycomb Maps to connect to Snowflake.

External OAuth ​

An external identity provider (IdP), such as Okta, serves as the Authorization Server. Snowflake serves as the resource server. Setup is similar to Snowflake OAuth

The user is redirected to the external IdP (such as Okta) to log in. If they already have a session, this may be skipped. Honeycomb Maps then presents an identity token (JWT) issued by the IdP to Snowflake when requesting data

Programmatic Access Tokens (PAT) - Snowflake PAT Setup Guide ​

An admin creates a PAT, and saves it to Honeycomb. Honeycomb includes this token with requests to Snowflake.

  • User-independent

Workload identity federation ​

Honeycomb Maps retrieves a signed JWT from the cloud provider it is running on (AWS, GCP, Azure), attesting to its identity. This is then passed to Snowflake as a connection parameter. Snowflake validates the token, proving that the application is running on trusted infrastructure.

Authenticating to Databricks ​

Databricks OAuth (U2M) - Databricks OAuth Setup Guide ​

Databricks serves as the Identity Provider (IdP) for an OAuth 2.0 Authentication Code Flow process. Honeycomb Maps acts as the client.

When setting up the connection, the user is redirected to a Databricks window (the 'Consent Screen'), asked to sign in if they aren't already, and then is asked to allow Honeycomb Maps to connect to Databricks.

Databricks OAuth (M2M) ​

This model uses the OAuth 2.0 M2M specification. Honeycomb Maps acts as the client, and exchanges a client ID and client secret for a short-lived access token. Honeycomb Maps then uses this access token to fetch data from Databricks.

OAuth Token Federation (external identity provider) ​

  • An external identity provider (IdP), such as Okta, serves as the Authorization Server. Databricks serves as the resource server.
  • The user is redirected to the external IdP (such as Okta) to log in. If they already have a session, this may be skipped. Honeycomb Maps then exchanges an identity token (JWT) issued by the IdP with Databricks, which provides a Databricks OAuth token. This Databricks OAuth token is then used to access resources.
  • User-based (Databricks describes this as "U2M")
  • See Databricks documentation here: https://docs.databricks.com/aws/en/dev-tools/auth/oauth-federation

Programmatic Access Tokens (PAT) ​

  • An admin creates a PAT, and saves it to Honeycomb. Honeycomb includes this token with requests to Databricks.
  • User-independent
  • Least secure. Where possible, Databricks recommends using OAuth instead of PATs for user account authentication because OAuth provides stronger security.
  • See Databricks documentation here: https://docs.databricks.com/aws/en/dev-tools/auth/pat

Workload identity federation ​

Honeycomb Maps retrieves a signed JWT from the cloud provider it is running on (AWS, GCP, Azure), attesting to its identity. Honeycomb Maps then exchanges this token with Databricks for a short-lived access token, using the OAuth 2.0 token exchange process.

Copyright © 2026 Honeycomb Maps