- Newest
- Most votes
- Most comments
Yes, you do need a trusted token issuer when using the BrowserIdcAuthPlugin in the Python redshift-connector. The plugin relies on an identity provider (IdP) to authenticate and issue tokens, which Redshift uses to grant access. This can complicate things because the setup requires more steps to ensure that the token is trusted and valid.
On the other hand, the BrowserAzureOAuth2CredentialsProvider is much simpler because Azure manages most of the complexity behind the scenes, making it a more streamlined option. That’s why it feels less of a hassle—Azure handles the token issuance process without requiring much configuration on your end.
If you’re finding the BrowserIdcAuthPlugin frustrating, you might want to check whether you’re properly configuring the IdP and the token exchange process. Sometimes small misconfigurations can make things seem unnecessarily complicated.
If anyone ends up here, this will help
The first link shows u how to set up your iam identity center “app” from the redshift console area (on the left in redshift in aws console there’s iam identity center). This lets redshift create and manage the app, including a second (kinda hidden) app so it can talk with query editor v2. Then you set up a “trusted token provider” for that app (the url is standard for the provider, for azure has the tenant id in it, the aud claim is the client id of the azure app for Microsoft).
The second link shows you how to use it, u basically set up your own web server :( in python that intercepts the oauth code request, then use that to get the token, and have to manually deal with storing and refreshing it.
How to get this to work with odbc iamidcbrowser plugin I have no idea and frankly don’t care.
So the point is redshift did this out of the box much simpler directly with azure, but query editor v2 and data api couldn’t support it, although the redshift python connector library did have the azure browser oauth plugin so it wasn’t a big deal. Now if you want to use it with the data api and query editor v2, you need to add the extra layer of trusted token provider between azure and redshift, instead of going straight from azure to redshift, which was the only identity provider they gave you out of the box until recently. Oh and redshift auto assigns the iam identity center groups to the user sessions, but doesn’t auto create the groups like it does for azure integration.
Oh and like okta and other directory services that u could plug in to iam identity center didn’t go all the way through to redshift. So moral of the story: if ur in azure and don’t care about query editor v2 and cli data api, just use the azure identity provider with the simpler instructions. But if you want to manage your group permissions solely through iam identity center or are on okta, then good luck fighting with the oidc gods.
answered 2 years ago
Relevant content
- AWS OFFICIALUpdated 6 months ago
So how exactly do I set that up? Docs just say “you may need this, but I’m not gonna tell u how to do it”