HDinsight ID Broker (HIB) is now generally available. HIB provides OAuth authentication on the cluster gateway and allows you to have single-sign-on (SSO) experience and sign in to Apache Ambari through Multi-Factor Authentication (MFA) without needing to sync on-premise password hashes to Azure Active Directory Domain Services (AAD-DS).
Federated users can now submit jobs to cluster using Apache beeline or Livy API without needing to have password hashes synced to AAD-DS.
Learn more about HIB and sample clients using OAuth.