@@ -58,8 +58,21 @@ To rotate a key, create the new key in AWS, reconnect the credential with it, co
 Keyless roles need two things on a self-hosted deployment:
 
 - `WORKLOAD_IDENTITY_SIGNING_KEY`: a PKCS#8 PEM RSA private key that signs Sim's tokens.
-- An issuer AWS can reach over the public internet. It defaults to `<NEXT_PUBLIC_APP_URL>/oidc/workload`; set `WORKLOAD_IDENTITY_ISSUER` to pin it. Trust policies reference this URL, so never change it once roles trust it.
+- An issuer AWS can reach over the public internet: an `https` URL on the default port, served by a certificate from a public CA. It defaults to `<NEXT_PUBLIC_APP_URL>/oidc/workload`; set `WORKLOAD_IDENTITY_ISSUER` to pin it. Trust policies reference this URL, so never change it once roles trust it. Sim keeps keyless off when the issuer isn't `https` or names a port, because AWS can't use it.
 
-To rotate the signing key, move the old key to `WORKLOAD_IDENTITY_PREVIOUS_KEY` and set a new `WORKLOAD_IDENTITY_SIGNING_KEY`. Both keys stay published until you remove the old one.
+Generate a key with `openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048`.
+
+To rotate the signing key without failed runs:
+
+1. Set the new key as `WORKLOAD_IDENTITY_PREVIOUS_KEY` and redeploy. Sim publishes it but keeps signing with the current key.
+2. Wait at least 5 minutes, so every cached copy of the published keys includes the new one.
+3. Swap them: set the new key as `WORKLOAD_IDENTITY_SIGNING_KEY` and the old key as `WORKLOAD_IDENTITY_PREVIOUS_KEY`, and redeploy.
+4. After 5 more minutes, remove `WORKLOAD_IDENTITY_PREVIOUS_KEY`.
 
 Without a signing key, the keyless option is unavailable and access keys work as usual.
+
+## Troubleshooting
+
+- **`InvalidIdentityToken` or "No OpenIDConnect provider found":** the IAM identity provider's URL or audience doesn't match the dialog exactly, or AWS can't reach the issuer. Open `<issuer>/.well-known/openid-configuration` from outside your network; it must load over `https`.
+- **`AccessDenied` when saving:** the role's trust policy doesn't trust this credential's subject. Paste the trust policy from the dialog again; if you chose **Issue a new subject**, update the policy to the new one.
+- **"This role trusts every Sim subject":** the trust policy is missing the `sub` condition. Use the policy from the dialog.
@@ -29,15 +29,20 @@ Every option resolves on Sim's servers at run time; tokens never appear in block
     In Sim, add a **Databricks connection**, choose **Service principal (keyless, via Sim OIDC)**, and enter the workspace host and the service principal's **application ID**.
   </Step>
   <Step>
-    A Databricks account admin runs the **Federation policy** command from the dialog with the service principal's numeric ID. The policy trusts Sim's issuer, the Sim audience, and this connection's subject only.
+    A Databricks account admin runs the **Federation policy** command from the dialog with the service principal's numeric ID (find it with `databricks account service-principals list --filter 'applicationId eq "<application ID>"'`, or on the service principal's page in the account console). The policy trusts Sim's issuer, the Sim audience, and this connection's subject only.
   </Step>
   <Step>
-    Make sure the service principal can access the workspace and the resources your workflows use, then save. Sim verifies the connection by exchanging a token and reading the service principal's identity.
+    Make sure the service principal can access the workspace and the resources your workflows use, then save. Sim verifies the connection by exchanging a token and reading the service principal's identity, and refuses a policy that would also trust a different subject, since every Sim workspace shares the issuer and audience.
   </Step>
 </Steps>
 
 Reconnecting a keyless connection keeps its subject by default, so the federation policy keeps working.
 
 ## Self-hosted deployments
 
-Keyless connections need `WORKLOAD_IDENTITY_SIGNING_KEY` set and an issuer Databricks can reach over the public internet. See [AWS credentials](/integrations/aws-credentials#self-hosted-deployments) for the same settings.
+Keyless connections need `WORKLOAD_IDENTITY_SIGNING_KEY` set and an `https` issuer Databricks can reach over the public internet. See [AWS credentials](/integrations/aws-credentials#self-hosted-deployments) for the same settings and for rotating the signing key.
+
+## Troubleshooting
+
+- **"Databricks rejected the token request":** the federation policy's issuer, audience, or subject doesn't match the dialog, or the policy is on a different service principal than the application ID you entered.
+- **"This service principal's federation policy trusts every Sim subject":** the policy has no `subject`. Recreate it with the command from the dialog.
@@ -167,10 +167,10 @@ Saved AWS and Databricks credentials can trust Sim through OpenID Connect instea
 | Variable | Description |
 | --- | --- |
 | `WORKLOAD_IDENTITY_SIGNING_KEY` | PKCS#8 PEM RSA private key that signs Sim's workload-identity tokens: `openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048` |
-| `WORKLOAD_IDENTITY_ISSUER` | Issuer URL clouds trust. Defaults to `<NEXT_PUBLIC_APP_URL>/oidc/workload` and must be reachable from the public internet. Never change it once trust policies reference it. |
-| `WORKLOAD_IDENTITY_PREVIOUS_KEY` | During rotation, the retiring key (private or public PEM), still published so tokens it signed keep verifying |
+| `WORKLOAD_IDENTITY_ISSUER` | Issuer URL clouds trust. Defaults to `<NEXT_PUBLIC_APP_URL>/oidc/workload`; must be `https` on the default port and reachable from the public internet, or keyless stays off. Never change it once trust policies reference it. |
+| `WORKLOAD_IDENTITY_PREVIOUS_KEY` | A second published key (private or public PEM) that never signs: the incoming key before a rotation, or the retiring key after it |
 
-See [AWS credentials](/integrations/aws-credentials#self-hosted-deployments).
+See [AWS credentials](/integrations/aws-credentials#self-hosted-deployments) for setup and the rotation steps.
 
 ## Access control
 
 
@@ -8,6 +8,9 @@ import { encryptionMock, encryptionMockFns } from '@sim/testing/mocks/encryption
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 vi.mock('@/lib/core/security/encryption', () => encryptionMock)
+vi.mock('@/lib/credentials/workload-identity/issuer', () => ({
+  mintWorkloadIdentityToken: async ({ subject }: { subject: string }) => `token-for:${subject}`,
+}))
 
 import { credential } from '@sim/db/schema'
 import {
@@ -56,6 +59,76 @@ describe('saving a Databricks connection', () => {
   })
 })
 
+describe('saving a keyless Databricks connection', () => {
+  const HOST = 'dbc-1234abcd-5678.cloud.databricks.com'
+  const CLIENT_ID = '00000000-0000-0000-0000-000000000000'
+  const SUBJECT = 'sim:workspace:ws-1:credential:abcdef0123456789'
+  const fetch = vi.fn()
+  const config = { authType: 'oidc_federation', host: HOST, clientId: CLIENT_ID }
+  const reconnectOwner = {
+    ...owner,
+    storedSecret: { type: 'databricks_credential_v1', config: { ...config, subject: SUBJECT } },
+  }
+
+  /** A service principal whose federation policy pins `subject` to {@link SUBJECT}, or trusts any subject. */
+  function principalTrusting(pinsSubject: boolean, probeStatus = 401) {
+    fetch.mockImplementation(async (url: string, init: RequestInit) => {
+      if (url.endsWith('/oidc/v1/token')) {
+        const body = new URLSearchParams(String(init.body))
+        const trusted = !pinsSubject || body.get('subject_token') === `token-for:${SUBJECT}`
+        return trusted
+          ? jsonResponse({ access_token: 'dbx-token' })
+          : jsonResponse({ error: 'invalid_grant' }, probeStatus)
+      }
+      return jsonResponse({ userName: 'sim-workflows' })
+    })
+  }
+
+  beforeEach(() => {
+    fetch.mockReset()
+    vi.stubGlobal('fetch', fetch)
+    encryptionMockFns.mockEncryptSecret.mockReset()
+    encryptionMockFns.mockEncryptSecret.mockResolvedValue({ encrypted: 'ciphertext', iv: 'iv' })
+  })
+
+  it('exchanges this credential’s token as the service principal and saves', async () => {
+    principalTrusting(true)
+
+    await expect(
+      verifyAndEncryptDatabricksCredential(JSON.stringify(config), reconnectOwner)
+    ).resolves.toMatchObject({ identity: 'sim-workflows' })
+    const exchange = fetch.mock.calls
+      .map(([url, init]) => ({ url, body: new URLSearchParams(String(init?.body)) }))
+      .find(({ body }) => body.get('subject_token') === `token-for:${SUBJECT}`)
+    expect(exchange?.url).toBe(`https://${HOST}/oidc/v1/token`)
+    expect(Object.fromEntries(exchange?.body ?? [])).toEqual({
+      client_id: CLIENT_ID,
+      subject_token: `token-for:${SUBJECT}`,
+      subject_token_type: 'urn:ietf:params:oauth:token-type:jwt',
+      grant_type: 'urn:ietf:params:oauth:grant-type:token-exchange',
+      scope: 'all-apis',
+    })
+  })
+
+  it('refuses a federation policy that trusts any Sim subject, so no other workspace can use it', async () => {
+    principalTrusting(false)
+
+    await expect(
+      verifyAndEncryptDatabricksCredential(JSON.stringify(config), reconnectOwner)
+    ).rejects.toThrow(/every Sim subject/)
+    expect(encryptionMockFns.mockEncryptSecret).not.toHaveBeenCalled()
+  })
+
+  it('does not save when the any-subject check cannot be completed', async () => {
+    principalTrusting(true, 503)
+
+    await expect(
+      verifyAndEncryptDatabricksCredential(JSON.stringify(config), reconnectOwner)
+    ).rejects.toThrow(/could not confirm/)
+    expect(encryptionMockFns.mockEncryptSecret).not.toHaveBeenCalled()
+  })
+})
+
 describe('getting a Databricks token for a run', () => {
   const fetch = vi.fn()
 
 
@@ -17,6 +17,7 @@ import {
 } from '@/lib/credentials/workload-identity/issuer'
 import {
   bindWorkloadIdentitySubject,
+  newWorkloadIdentitySubject,
   type WorkloadIdentityCredentialOwner,
   WorkloadIdentitySubjectError,
 } from '@/lib/credentials/workload-identity/subject'
@@ -223,6 +224,66 @@ function bindSubject(
   }
 }
 
+/** Proves a configuration by calling the workspace's SCIM `Me` with the resolved token. */
+async function verifyWorkspaceIdentity(
+  config: DatabricksCredentialConfig,
+  owner: WorkloadIdentityOwner
+): Promise<string> {
+  try {
+    const token = await resolveDatabricksAccessToken(config, owner)
+    const response = await fetch(`${workspaceOrigin(config.host)}/api/2.0/preview/scim/v2/Me`, {
+      headers: { Authorization: `Bearer ${token}`, Accept: 'application/json' },
+      redirect: 'error',
+      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+    })
+    if (!response.ok) throw new Error(`workspace returned HTTP ${response.status}`)
+    const me = (await response.json().catch(() => ({}))) as {
+      userName?: unknown
+      displayName?: unknown
+    }
+    return (
+      (typeof me.userName === 'string' && me.userName) ||
+      (typeof me.displayName === 'string' && me.displayName) ||
+      config.host
+    )
+  } catch (error) {
+    throw new DatabricksCredentialError(
+      `Could not verify the Databricks credential: ${getErrorMessage(error, 'Unknown error')}`
+    )
+  }
+}
+
+/**
+ * Sim signs tokens for any service principal a member names, and every Sim
+ * tenant shares the issuer and audience, so a federation policy that doesn't
+ * pin `subject` would let any Sim workspace act as the principal. Exchanging a
+ * subject no credential holds must be refused before the credential is saved.
+ */
+async function assertPolicyPinsSubject(
+  config: Extract<DatabricksCredentialConfig, { authType: 'oidc_federation' }>,
+  owner: WorkloadIdentityOwner
+): Promise<void> {
+  try {
+    await resolveDatabricksAccessToken(
+      { ...config, subject: newWorkloadIdentitySubject(owner) },
+      owner,
+      AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+    )
+  } catch (error) {
+    const refused =
+      error instanceof DatabricksCredentialError &&
+      error.status !== undefined &&
+      providerFailureCode(error.status) === 'invalid_credentials'
+    if (refused) return
+    throw new DatabricksCredentialError(
+      `Sim could not confirm the federation policy limits this service principal to this credential: ${getErrorMessage(error, 'Unknown error')}. Try again.`
+    )
+  }
+  throw new DatabricksCredentialError(
+    `This service principal's federation policy trusts every Sim subject. Use the policy shown in the dialog, whose subject is ${config.subject}, so only this credential can use it.`
+  )
+}
+
 /**
  * Validates the submitted configuration, proves it by calling the workspace's
  * SCIM `Me` endpoint with the resolved token, and returns the encrypted blob
@@ -247,28 +308,15 @@ export async function verifyAndEncryptDatabricksCredential(
     config = submitted
   }
 
-  let identity: string
-  try {
-    const token = await resolveDatabricksAccessToken(config, owner)
-    const response = await fetch(`${workspaceOrigin(config.host)}/api/2.0/preview/scim/v2/Me`, {
-      headers: { Authorization: `Bearer ${token}`, Accept: 'application/json' },
-      redirect: 'error',
-      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
-    })
-    if (!response.ok) throw new Error(`workspace returned HTTP ${response.status}`)
-    const me = (await response.json().catch(() => ({}))) as {
-      userName?: unknown
-      displayName?: unknown
-    }
-    identity =
-      (typeof me.userName === 'string' && me.userName) ||
-      (typeof me.displayName === 'string' && me.displayName) ||
-      config.host
-  } catch (error) {
-    throw new DatabricksCredentialError(
-      `Could not verify the Databricks credential: ${getErrorMessage(error, 'Unknown error')}`
-    )
-  }
+  // The subject-pin probe is independent of the verification, so both run at
+  // once; a verification failure still reports first.
+  const [verified, pinned] = await Promise.allSettled([
+    verifyWorkspaceIdentity(config, owner),
+    config.authType === 'oidc_federation' ? assertPolicyPinsSubject(config, owner) : undefined,
+  ])
+  if (verified.status === 'rejected') throw verified.reason
+  if (pinned.status === 'rejected') throw pinned.reason
+  const identity = verified.value
 
   const { encrypted } = await encryptSecret(
     JSON.stringify({ type: DATABRICKS_CREDENTIAL_SECRET_TYPE, config })
 
@@ -26,6 +26,7 @@ async function loadIssuer() {
 describe('workload identity issuer', () => {
   beforeEach(() => {
     setEnv('WORKLOAD_IDENTITY_SIGNING_KEY', rsaPem())
+    setEnv('WORKLOAD_IDENTITY_ISSUER', 'https://sim.example.com/oidc/workload')
   })
 
   afterEach(() => {
@@ -101,6 +102,20 @@ describe('workload identity issuer', () => {
     expect((await workloadIdentityJwksResponse()).status).toBe(404)
   })
 
+  it.each(['http://sim.example.com/oidc/workload', 'https://sim.example.com:3000/oidc/workload'])(
+    'stays off for an issuer no cloud can fetch (%s)',
+    async (url) => {
+      setEnv('WORKLOAD_IDENTITY_ISSUER', url)
+      const issuer = await loadIssuer()
+      const { workloadIdentityDiscoveryResponse } = await import(
+        '@/lib/credentials/workload-identity/responses'
+      )
+
+      expect(await issuer.isWorkloadIdentityConfigured()).toBe(false)
+      expect((await workloadIdentityDiscoveryResponse()).status).toBe(404)
+    }
+  )
+
   it('keeps signing with the current key when the retiring key is malformed', async () => {
     setEnv('WORKLOAD_IDENTITY_PREVIOUS_KEY', 'not a PEM key')
     const issuer = await loadIssuer()
 
@@ -70,6 +70,24 @@ async function loadPreviousPublicJwk(): Promise<JWK | null> {
   }
 }
 
+/**
+ * AWS and Databricks fetch discovery and keys from the issuer over https on the
+ * default port, so any other issuer can never be trusted; keyless stays off
+ * rather than advertising an issuer no relying party accepts.
+ */
+function assertPublicIssuer(issuer: string): void {
+  const url = new URL(issuer)
+  if (url.protocol !== 'https:' || url.port) {
+    throw new Error('Workload identity issuer must be an https URL without a port')
+  }
+  if (!env.WORKLOAD_IDENTITY_ISSUER?.trim()) {
+    logger.warn(
+      'Workload identity issuer follows the app URL; set WORKLOAD_IDENTITY_ISSUER so customer trust policies survive a URL change',
+      { issuer }
+    )
+  }
+}
+
 let signingMaterial: Promise<SigningMaterial> | undefined
 
 /**
@@ -82,6 +100,7 @@ function loadSigningMaterial(): Promise<SigningMaterial> {
   if (!signingKey) return Promise.reject(new WorkloadIdentityNotConfiguredError())
   if (!signingMaterial) {
     signingMaterial = (async () => {
+      assertPublicIssuer(getWorkloadIdentityIssuer())
       const privateKey = createPrivateKey(normalizePem(signingKey))
       const current = await toPublicJwk(privateKey)
       const keys = [current]