Skip to main content

Set up external OAuth with Redshift EnterpriseEnterprise +

note

This feature is currently only available for Okta and Entra ID identity providers.

dbt Enterprise and Enterprise+ plans support OAuth authentication with external providers. When External OAuth is enabled, users can authorize their Development credentials using single sign-on (SSO) via the identity provider (IdP). External OAuth authorizes users to access multiple applications, including dbt, without sharing their static credentials with the service. This makes the process of authenticating for development environments easier for the user and provides an additional layer of security to your dbt account.

Getting started

The process of setting up external OAuth will require a little bit of back-and-forth between your dbt, IdP, and data warehouse accounts, and having them open in multiple browser tabs will help speed up the configuration process:

  • dbt: You’ll primarily be working in the Account settings —> Integrations page. You will need proper permission to set up the integration and create the connections.
  • Identity providers:
    • Okta: You’ll be working in multiple areas of the Okta account, but you can start in the Applications section. You will need permissions to create an application and an authorization server.
    • Entra ID An admin with access to create Entra ID apps who is also a user in the data warehouse is required.
  • Data warehouse:

If the admins that handle these products are all different people, it’s better to have them coordinating simultaneously to reduce friction.

Ensure your Amazon admins have completed the Amazon Identity Center integration with Okta or Entra ID.

Identity provider configuration

Select a supported identity provider (IdP) for instructions on configuring external OAuth in their environment and completing the integration in dbt:

1. Initialize the dbt settings

  1. In your dbt account, navigate to Account settings —> Integrations.
  2. Scroll down to Custom integrations and click Add integrations
  3. Leave this window open. You can set the Integration type to Okta and note the Redirect URI at the bottom of the page. Copy this to your clipboard for use in the next steps.
Copy the callback URI at the bottom of the integration page in dbt.Copy the callback URI at the bottom of the integration page in dbt.

2. Create the Okta app

  1. Expand the Applications section from the Okta dashboard and click Applications. Click the Create app integration button.
  2. Select OIDC as the sign-in method and Web applications as the application type. Click Next.
The Okta app creation window with OIDC and Web Application selected.The Okta app creation window with OIDC and Web Application selected.
  1. Give the application an appropriate name, something like “External OAuth app for dbt,” that will make it easily identifiable.
  2. In the Grant type section, enable the Refresh token option.
  3. Scroll down to the Sign-in redirect URIs option. You’ll need to paste the redirect URI you gathered from dbt in step 1.3.
The Okta app configuration window with the sign-in redirect URI configured to the dbt value.The Okta app configuration window with the sign-in redirect URI configured to the dbt value.
  1. Save the app configuration. You’ll come back to it, but move on to the next steps for now.

3. Create the Okta API

  1. Expand the Security section and click API from the Okta sidebar menu.
  2. On the API screen, click Add authorization server. Give the authorization server a name (a nickname for your data warehouse account would be appropriate). For the Audience field, copy and paste your data warehouse login URL. Give the server an appropriate description and click Save.
The Okta API window with the Audience value set.The Okta API window with the Audience value set.
  1. On the authorization server config screen, open the Metadata URI in a new tab. You’ll need information from this screen in later steps.
The Okta API settings page with the metadata URI highlighted.The Okta API settings page with the metadata URI highlighted.
Sample output of the metadata URI.Sample output of the metadata URI.
  1. Click on the Scopes tab and Add scope. In the Name field, add session:role-any. (Optional) Configure Display phrase and Description and click Create.
API scope configured in the Add Scope window.API scope configured in the Add Scope window.
  1. Open the Access policies tab and click Add policy. Give the policy a Name and Description and set Assign to as The following clients. Start typing the name of the app you created in step 2.3, and you’ll see it autofill. Select the app and click Create Policy.
Assignment field autofilling the value.Assignment field autofilling the value.
  1. On the access policy screen, click Add rule.
API Add rule button highlighted.API Add rule button highlighted.
  1. Give the rule a descriptive name and scroll down to token lifetimes. Configure the Access token lifetime is, Refresh token lifetime is, and but will expire if not used every settings according to your organizational policies. We recommend the defaults of 1 hour and 90 days. Stricter rules increase the odds of your users having to re-authenticate.
Token lifetime settings in the API rule window.Token lifetime settings in the API rule window.
  1. Navigate back to the Settings tab and leave it open in your browser. You’ll need some of the information in later steps.

4. Create the OAuth settings in the data warehouse

Ensure your Amazon admins have completed the Identity Center integration with Okta.

Configure the Okta application and APIs in accordance with your Amazon configs.

5. Configuring the integration in dbt

  1. Navigate back to the dbt Account settings —> Integrations page you were on at the beginning. It’s time to start filling out all of the fields.

    1. Integration name: Give the integration a descriptive name that includes identifying information about the Okta environment so future users won’t have to guess where it belongs.
    2. Client ID and Client secrets: Retrieve these from the Okta application page.
    The client ID and secret highlighted in the Okta app.The client ID and secret highlighted in the Okta app.
    1. Authorize URL and Token URL: Found in the metadata URI.
    The authorize and token URLs highlighted in the metadata URI.The authorize and token URLs highlighted in the metadata URI.
  2. Save the configuration

6. Create a new connection in dbt

  1. Navigate to Account settings and click Connections from the menu. Click New connection.
  2. Configure the Account, Database, and Warehouse as you normally would, and for the OAuth method, select the external OAuth you just created.
The new configuration window in dbt with the External OAuth showing as an option.The new configuration window in dbt with the External OAuth showing as an option.
  1. Scroll down to the External OAuth configurations box and select the config from the list.
The new connection displayed in the External OAuth Configurations box.The new connection displayed in the External OAuth Configurations box.
  1. Save the connection, and you have now configured External OAuth with Okta!

Configure the Trusted Token Issuer in IAM IdC

trusted token issuer generates an access token that is used to identify a user, and then authenticates that user. This essentially lets services outside of the AWS ecosystem, such as the dbt platform, connect to IAM IdC (and Redshift) with access tokens they have generated or retrieved from an external IdP (Entra ID or Okta).

The following steps are outlined per this blog post:

  1. Open the AWS Management Console and navigate to IAM Identity Center, and then to the Settings.
  2. Select the Authentication tab and under Trusted token issuers, choose Create trusted token issuer.
  3. On the Set up an external IdP to issue trusted tokens page, under Trusted token issuer details, do the following:
    1. For Issuer URL, enter the OIDC discovery URL of the external IdP that will issue tokens for trusted identity propagation. Include the forward slash at the end of the URL.
    2. For Trusted token issuer name, enter a name to identify this TTI in IAM Identity Center and the application console.
    3. Under Map attributes, do the following:
      1. For Identity provider attribute, select an attribute from the list to map to an attribute in the Identity Center identity store. You can choose:
      • Email 
      • Object Identifier
      • Subject
      • Other — When using this options with UPN, it's been our experience that upn matched up with Email.

Configure Redshift IdC application to utilize TTI

To start, select IAM Identity Center connection from the Amazon Redshift console menu.

The AWS Redshift console.The AWS Redshift console.
  1. Select the Amazon Redshift application that you created as part of the setup.
  2. Select the Client connections tab and choose Edit.
  3. Choose Yes under Configure client connections that use third-party IdPs.
  4. Select the checkbox for Trusted token issuer that you created in the previous section.
  5. Enter the aud claim value under Configure selected trusted token issuers. This should be the application ID URI you set for the integration in the dbt platform.

Finalizing the dbt configuration

If you have an existing connection, make sure that the OAuth method is set to External OAuth and select the integration you created in an earlier step. Otherwise, create a new Redshift connection, being sure to set values for:

  • Server Hostname
  • OAuth Method
  • Database name (this field can be found under the Optional Settings)

This connection should be set as the connection for a development environment in an existing or new project.

Once the connection has been assigned to a development environment, you can configure your user credentials for that development environment under Account Settings > Your Profile > Credentials > <Your Project Name>. Set the authentication method to External OAuth, set the schema and other fields if desired, and save the credentials. You can then click the Connect to Redshift button.

Verify connection in Studio

Once your development session has initialized, you can test that you’re able to connect to Redshift using external OAuth by running dbt debug.

Was this page helpful?

0