Set Up Amazon Redshift IAM OAuth


Important: The Redshift ODBC driver currently deployed to Tableau Cloud does not support OAuth. The next release of the driver from Amazon, which will includes fixes, is scheduled for early April. This should be deployed to Tableau Cloud several weeks later. Until then if you want to use IAM OAuth for Redshift on Tableau Cloud, you can use the latest 1.x version of the driver with Tableau Bridge.

Starting in Tableau 2023.3.2 for on premise (Tableau Desktop, Tableau Server, and Tableau Prep) and April 2024 for Tableau Cloud, you can use OAuth 2.0/OIDC to federate identity from an external identity provider to Amazon Redshift. Tableau Bridge can be used as a workaround on Tableau Cloud until this feature is available. For more information on Bridge, see Use Bridge to Keep Data Fresh.

These instructions are for the older AWS IAM service. For IAM IDC integration see Set Up Amazon Redshift IAM Identity Center OAuth.

Depending on the identity provider, there are different steps needed to configure the integration. This is a high level overview. Tableau cannot provide detailed instructions for how to configure AWS or the IDP, but the general approach is described below.

Configure the IDP

  1. Create OAuth clients on the IDP for Tableau Desktop, and Tableau Server or Tableau Cloud. The Desktop client should enable PKCE and use http://localhost redirects.

  2. Add custom claims to use for authorization to roles. In particular, if you are using original IAM, you may want to add claims for DbUser and DbGroups. These can be used in your IAM policies later.

  3. Create the Tableau OAuth config files. See documentation on GitHub(Link opens in a new window), and examples here(Link opens in a new window). We welcome examples for other IDPs.

    1. Be sure to prefix the Tableau OAuth config IDs with “custom_”.

    2. If your IDP supports dynamic localhost port then disable OAUTH_CAP_FIXED_PORT_IN_CALLBACK_URL. If your IDP does not support this, make sure to add several localhost callback URLs to the allowlist in the config file and on the IDP.

  4. Install Tableau OAuth config files on desktop machines and Tableau Server or Tableau Cloud sites.

Configure IDP on AWS

1. Create the IDP model on the AWS. See Amazon docs Web Identity Federation(Link opens in a new window) and Create OIDC Identity Provider(Link opens in a new window).

2. Create roles and policies specifically for the IDP. See Create Role for OIDC(Link opens in a new window) in the AWS docs.

Configure Roles for Redshift Users

Attach the policies needed for Redshift. You may use custom claims from the token to authorize to roles. There are several examples with SAML in the AWS documentation(Link opens in a new window). These can be easily adapted to OAuth. In the case of OAuth, the claims are just “DbUser”, “DbGroups”, etc.

Here is an example of the policy from the AWS documentation:

{
"Version": "2012-10-17",
"Statement": [
    {
        "Effect": "Allow",
        "Action": "redshift:GetClusterCredentials",
        "Resource": [
            "arn:aws:redshift:us-west-1:123456789012:dbname:cluster-identifier/dev",
            "arn:aws:redshift:us-west-1:123456789012:dbuser:cluster-identifier/${redshift:DbUser}",
            "arn:aws:redshift:us-west-1:123456789012:cluster:cluster-identifier"
        ],
        "Condition": {
            "StringEquals": {
                "aws:userid": "AROAJ2UCCR6DPCEXAMPLE:${redshift:DbUser}@example.com"
            }
        }
    },
    {
        "Effect": "Allow"
        "Action": "redshift:CreateClusterUser",
        "Resource": "arn:aws:redshift:us-west-1:12345:dbuser:cluster-identifier/${redshift:DbUser}"
    },
    {
        "Effect": "Allow",
        "Action": "redshift:JoinGroup",
        "Resource": "arn:aws:redshift:us-west-1:12345:dbgroup:cluster-identifier/my_dbgroup"
    },
    {
        "Effect": "Allow",
        "Action": [
            "redshift:DescribeClusters",
            "iam:ListRoles"
        ],
        "Resource": "*"
    }
]
}

Connect to Redshift

The user must specify the role ARN to assume, and select the OAuth config installed earlier.

When properly configured, the user will be redirected to the IDP to authenticate and authorize tokens for Tableau. Tableau will receive openid and refresh tokens. AWS is able to validate the token and signature from the IDP, extract the claims from the token, look up the mapping of claims to IAM role, and either permit or block Tableau from assuming the role on the user’s behalf. (in other words, AssumeRoleWithWebIdentity(Link opens in a new window)).

Okta

If using Okta it’s better to use a “custom authorization server” rather than the “org authorization server.” The custom authorization servers are more flexible. There is a custom authorization server created by default, which is called “default”. The authorization URL should look like this:

https://${yourOktaDomain}/oauth2/{authServerName}/v1/authorize

 

Update Driver

For Redshift OAuth using the original IAM service, you may use either:

Troubleshooting

If you see an error message about invalid/expired token coming from the driver on the first connection (it will have a SQLState error code like [28000] or [08001] in the error message), then we successfully completed the OAuth flow, and failed in the driver. This means there is a misconfiguration on either the AWS side or the IDP side. There may also be permissions or authorization errors returned from the driver, which is also out of our control.

The best way to diagnose these errors is to remove Tableau from the picture. You first need to get an ID token (the default) or access token (if customized) to send to the driver. Here is an example with Okta. Almost all IDPs have a way to do this which is quite similar. Note that to use this flow you need to have enabled resource owner password grant type. Substitute the IDP URL, client secret, client ID, username, and password.

curl -X POST "https://OKTA_URL/v1/token" \
-H 'accept: application/json' \
-H "Authorization: Basic $(echo -n 'CLIENTID:CLIENTSECRET' | base64)" \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "grant_type=password&username=USER&password=PASSWORD&scope=openid"

Once you have the token, you can use a DSN to test. Below is an example of using the ODBC driver manager on Windows. On Mac you can use the iODBC driver manager UI. On Linux you can use the isql command line tool that is included with Tableau Server in the customer-bin folder.

Back to top
Thanks for your feedback!Your feedback has been successfully submitted. Thank you!