Skip to content

Commit 18c2d7a

Browse files
Brooke-whiteBrooke-white
committed
Added support for a new browser authentication plugin called BrowserIdcAuthPlugin to facilitate single-sign-on integration with AWS IAM Identity Center.
1 parent 26fc02d commit 18c2d7a

File tree

14 files changed

+780
-5
lines changed

14 files changed

+780
-5
lines changed

‎README.rst‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -333,12 +333,18 @@ Connection Parameters
333333
+-----------------------------------+------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+------------------------+----------+
334334
| iam_disable_cache | bool | This option specifies whether the IAM credentials are cached. By default the IAM credentials are cached. This improves performance when requests to the API gateway are throttled. | FALSE | No |
335335
+-----------------------------------+------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+------------------------+----------+
336+
| idc_client_display_name | str | The client display name to be used in user consent in IdC browser auth. This is an optional value. The default value is "Amazon Redshift Python connector". | None | No |
337+
+-----------------------------------+------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+------------------------+----------+
338+
| idc_region | str | The AWS region where AWS identity center instance is located. It is required for the IdC browser auth plugin. | None | No |
339+
+-----------------------------------+------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+------------------------+----------+
336340
| identity_namespace | str | The identity namespace to be used for the IdC browser auth plugin and IdP token auth plugin. It is an optional value if there is only one IdC instance existing or if default identity namespace is set on the cluster - else it is required. | None | No |
337341
+-----------------------------------+------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+------------------------+----------+
338342
| idp_response_timeout | int | The timeout for retrieving SAML assertion from IdP | 120 | No |
339343
+-----------------------------------+------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+------------------------+----------+
340344
| idp_tenant | str | The IdP tenant | None | No |
341345
+-----------------------------------+------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+------------------------+----------+
346+
| issuer_url | str | The issuer url for the AWS IdC access portal. It is required for the IdC browser auth plugin. | None | No |
347+
+-----------------------------------+------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+------------------------+----------+
342348
| listen_port | int | The listen port IdP will send the SAML assertion to | 7890 | No |
343349
+-----------------------------------+------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+------------------------+----------+
344350
| login_to_rp | str | Only for AdfsCredentialsProvider. Used to specify the loginToRp when performing IdpInitiatedSignOn as apart of form based authentication. | urn:amazon:webservices | No |

‎redshift_connector/__init__.py‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,8 @@
5757
_logger: logging.Logger = logging.getLogger(__name__)
5858

5959
IDC_PLUGINS_LIST = (
60+
"redshift_connector.plugin.BrowserIdcAuthPlugin",
61+
"BrowserIdcAuthPlugin",
6062
"redshift_connector.plugin.IdpTokenAuthPlugin",
6163
"IdpTokenAuthPlugin",
6264
)
@@ -65,6 +67,8 @@
6567
"BrowserAzureOAuth2CredentialsProvider",
6668
"redshift_connector.plugin.BasicJwtCredentialsProvider",
6769
"BasicJwtCredentialsProvider",
70+
"redshift_connector.plugin.BrowserIdcAuthPlugin",
71+
"BrowserIdcAuthPlugin",
6872
"redshift_connector.plugin.IdpTokenAuthPlugin",
6973
"IdpTokenAuthPlugin",
7074
)
@@ -158,6 +162,9 @@ def connect(
158162
serverless_work_group: typing.Optional[str] = None,
159163
group_federation: typing.Optional[bool] = None,
160164
identity_namespace: typing.Optional[str] = None,
165+
idc_client_display_name: typing.Optional[str] = None,
166+
idc_region: typing.Optional[str] = None,
167+
issuer_url: typing.Optional[str] = None,
161168
token: typing.Optional[str] = None,
162169
token_type: typing.Optional[str] = None,
163170
) -> Connection:
@@ -265,6 +272,12 @@ def connect(
265272
Use the IDP Groups in the Redshift. Default value False.
266273
identity_namespace: Optional[str]
267274
The identity namespace to be used with IdC auth plugin. Default value is None.
275+
idc_client_display_name: Optional[str]
276+
The client display name to be used in user consent in IdC browser auth. Default value is `Amazon Redshift Python connector`.
277+
idc_region: Optional[str]
278+
The AWS region where IdC instance is located. Default value is None.
279+
issuer_url: Optional[str]
280+
The issuer url for the AWS IdC access portal. Default value is None.
268281
token: Optional[str]
269282
The access token to be used with IdC basic credentials provider plugin. Default value is None.
270283
token_type: Optional[str]
@@ -296,10 +309,13 @@ def connect(
296309
info.put("host", host)
297310
info.put("iam", iam)
298311
info.put("iam_disable_cache", iam_disable_cache)
312+
info.put("idc_client_display_name", idc_client_display_name)
313+
info.put("idc_region", idc_region)
299314
info.put("identity_namespace", identity_namespace)
300315
info.put("idp_host", idp_host)
301316
info.put("idp_response_timeout", idp_response_timeout)
302317
info.put("idp_tenant", idp_tenant)
318+
info.put("issuer_url", issuer_url)
303319
info.put("is_serverless", is_serverless)
304320
info.put("listen_port", listen_port)
305321
info.put("login_url", login_url)
@@ -398,6 +414,7 @@ def connect(
398414
numeric_to_float=info.numeric_to_float,
399415
identity_namespace=info.identity_namespace,
400416
token_type=info.token_type,
417+
idc_client_display_name=info.idc_client_display_name,
401418
)
402419

403420

‎redshift_connector/core.py‎

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -433,6 +433,7 @@ def __init__(
433433
numeric_to_float: bool = False,
434434
identity_namespace: typing.Optional[str] = None,
435435
token_type: typing.Optional[str] = None,
436+
idc_client_display_name: typing.Optional[str] = None,
436437
):
437438
"""
438439
Creates a :class:`Connection` to an Amazon Redshift cluster. For more information on establishing a connection to an Amazon Redshift cluster using `federated API access <https://aws.amazon.com/blogs/big-data/federated-api-access-to-amazon-redshift-using-an-amazon-redshift-connector-for-python/>`_ see our examples page.
@@ -481,6 +482,8 @@ def __init__(
481482
The identity namespace to be used with IdC auth plugin. Default value is None.
482483
token_type: Optional[str]
483484
The token type to be used for authentication using IdP Token auth plugin
485+
idc_client_display_name: Optional[str]
486+
The client display name to be used for user consent in IdC browser auth plugin.
484487
"""
485488
self.merge_socket_read = True
486489

@@ -561,7 +564,10 @@ def get_calling_module() -> str:
561564
redshift_native_auth = True
562565
init_params["idp_type"] = "AzureAD"
563566

564-
if credentials_provider.split(".")[-1] in ("IdpTokenAuthPlugin",):
567+
if credentials_provider.split(".")[-1] in (
568+
"IdpTokenAuthPlugin",
569+
"BrowserIdcAuthPlugin",
570+
):
565571
redshift_native_auth = True
566572
self.set_idc_plugins_params(
567573
init_params, credentials_provider, identity_namespace, token_type
@@ -2617,12 +2623,18 @@ def set_idc_plugins_params(
26172623
credentials_provider: typing.Optional[str] = None,
26182624
identity_namespace: typing.Optional[str] = None,
26192625
token_type: typing.Optional[str] = None,
2626+
idc_client_display_name: typing.Optional[str] = None,
26202627
) -> None:
26212628
plugin_name = typing.cast(str, credentials_provider).split(".")[-1]
26222629
init_params["idp_type"] = "AwsIdc"
26232630

26242631
if identity_namespace:
26252632
init_params["identity_namespace"] = identity_namespace
26262633

2627-
if token_type:
2634+
if plugin_name == "BrowserIdcAuthPlugin":
2635+
init_params["token_type"] = "ACCESS_TOKEN"
2636+
elif token_type:
26282637
init_params["token_type"] = token_type
2638+
2639+
if idc_client_display_name:
2640+
init_params["idc_client_display_name"] = idc_client_display_name

‎redshift_connector/plugin/__init__.py‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44
from .browser_azure_oauth2_credentials_provider import (
55
BrowserAzureOAuth2CredentialsProvider,
66
)
7+
from .browser_idc_auth_plugin import BrowserIdcAuthPlugin
78
from .browser_saml_credentials_provider import BrowserSamlCredentialsProvider
89
from .common_credentials_provider import CommonCredentialsProvider
910
from .idp_credentials_provider import IdpCredentialsProvider

0 commit comments

Comments
 (0)