## Enable SSO for Amazon Redshift

URL: https://docs.atlan.com/apps/connectors/data-warehouses/amazon-redshift/how-tos/enable-sso-for-amazon-redshift

> You will need to [create a client application in Okta](https://help.okta.com/en-us/Content/Topics/Apps/Apps_App_Integration_Wizard_OIDC.htm) to use for [configuring the identity provider in AWS](/apps/connectors/data-warehouses/amazon-redshift/how-tos/enable-sso-for-amazon-redshift).

Atlan supports SSO authentication for [Amazon Redshift](https://docs.atlan.com/llms/connectors/amazon-redshift/set-up-amazon-redshift/llms.txt) connections with Okta as the identity provider. Once you've configured SSO authentication for Amazon Redshift, your users can:

- [Query data with Okta SSO credentials](https://docs.atlan.com/llms/governance/access-control/authenticate-sso-credentials-to-query-data/llms.txt)
- [View sample data with Okta SSO credentials](https://docs.atlan.com/llms/governance/access-control/authenticate-sso-credentials-to-query-data/llms.txt)

:::info **Did you know?** 
 If you have already configured Okta and AWS, skip to [configure SSO authentication in Atlan](https://docs.atlan.com/llms/connectors/amazon-redshift/enable-sso-for-amazon-redshift/llms.txt). Otherwise, complete all the steps below.

:::

## Create a client application in Okta

:::warning Who can do this?
 You will need your Okta administrator to complete these steps - you may not have access yourself. You will also need inputs and approval from your AWS administrator.

:::

You will need to [create a client application in Okta](https://help.okta.com/en-us/Content/Topics/Apps/Apps_App_Integration_Wizard_OIDC.htm) to use for [configuring the identity provider in AWS](https://docs.atlan.com/llms/connectors/amazon-redshift/enable-sso-for-amazon-redshift/llms.txt).

To create a client application, within Okta:

1. Log in to your Okta _Admin Console_.
2. From the left menu of the _Admin Console_, click **Applications**.
3. Under _Applications_, click the **Browse App Catalog** button.
4. On the _Browse App Integration Catalog_ page, search for and select **Amazon Web Services Redshift**.
5. From the _Amazon Web Services Redshift_ page, click the **Add integration** button to create an integration.
6. For _Add_ _Amazon Web Services Redshift_, enter the following details:
 1. For _Application label_, enter a meaningful name for your new app integration - for example, `Atlan_SSO`.
 2. Click **Done** to proceed.
7. On your new app page, click the **Assignments** tab and then click the **Assign** button:
 - Click **Assign to People** to select individual users to assign to the application.
 - Click **Assign to Groups** to select groups to assign to the application.
8. On your new app page, click the **Sign On** tab and then navigate to the _SAML Signing Certificates_ section:
 1. Under _Actions_, click **Actions** to expand the menu, and then from the dropdown, click **View IdP metadata**.
 2. This will open an XML file in a new tab. Save or download this file to use for [configuring the identity provider in AWS](https://docs.atlan.com/llms/connectors/amazon-redshift/enable-sso-for-amazon-redshift/llms.txt).
 3. For _User Authentication_, click the **Edit** button:
 1. From the _Authentication policy_ dropdown, click **Okta Dashboard**.
 2. Click **Save** to save your changes.

You will need the IdP metadata XML file to configure Okta as the identity provider in AWS.

## Configure identity provider in AWS

:::warning Who can do this?
 You will need your AWS administrator to complete these steps - you may not have access yourself. You will also need inputs and approval from your Okta administrator.

:::

You will need to establish a trust relationship between Okta as the identity provider and AWS. You will also need to create a role that Okta can use to access Amazon Redshift and assign required permissions to that role.

### Create an identity provider

To [create an identity provider](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_saml.html), within AWS:

1. Sign in to the AWS Management Console and open the AWS Identity and Access Management (IAM) console.

2. From the left menu of your AWS Identity and Access Management (IAM) console, click **Identity providers** and then click the **Add provider** button.
3. In the _Add an Identity provider_ dialog, enter the following details:
 1. For _Provider type_, select **SAML**.
 2. For _Provider name_, enter a name for the identity provider - for example, `Okta_AtlanSSO`.
 3. Under _Metadata document_, click **Choose file** and upload the [IdP metadata XML file you downloaded from Okta](https://docs.atlan.com/llms/connectors/amazon-redshift/enable-sso-for-amazon-redshift/llms.txt).
 4. At the bottom of the dialog, click **Add provider** to add Okta as the identity provider in AWS.

Once you have configured Okta as the identity provider in AWS, you will need to create a role for Okta to access Amazon Redshift.

### Create a role

To [create a role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-service.html#roles-creatingrole-service-console), within AWS:

1. Sign in to the AWS Management Console and open the AWS Identity and Access Management (IAM) console.
2. From the left menu of your AWS Identity and Access Management (IAM) console, click **Roles**, and then from the top right, click the **Create role** button.
3. On the _Create role_ page, enter the following details:
 1. For _Select trusted entity_, under _Trusted entity type_, click **SAML 2.0 federation**. Under _SAML 2.0 federation_, enter the following details: 
 1. For _SAML 2.0-based provider_, select [the identity provider you created in AWS](https://docs.atlan.com/llms/connectors/amazon-redshift/enable-sso-for-amazon-redshift/llms.txt) - for example, `Okta_AtlanSSO`.
 2. Click **Allow programmatic access only**.
 3. For the _Attribute_ dropdown, select `SAML:aud`.
 4. For _Value_, enter `https://signin.aws.amazon.com/saml`.
 5. Click **Next** to continue.
 2. For _Add permissions_, click **Next** to proceed to the next step.
 3. For _Name, review, and create_, under _Role details_, enter the following details:
 1. For _Role name_, enter a name for the role - for example, `Okta_AtlanSSO_role`.
 2. (Optional) For _Description_, enter a description for the new role.
 4. Click **Create role** to finish role setup. This will create a new role for Okta to access Amazon Redshift.

Once you have created a role for Okta to access Amazon Redshift, you will need to assign permissions to that role.

### Create a policy

You will need to create an access policy and assign the [following required permissions](https://docs.aws.amazon.com/redshift/latest/APIReference/API_GetClusterCredentials.html) to the newly created role:

- `CreateClusterUser`
- `JoinGroup`
- `GetClusterCredentials`

To create a policy, within AWS:

1. Sign in to the AWS Management Console and open the AWS Identity and Access Management (IAM) console.
2. From the left menu of your AWS Identity and Access Management (IAM) console, click **Roles** and then search for and select the [role you created](https://docs.atlan.com/llms/connectors/amazon-redshift/enable-sso-for-amazon-redshift/llms.txt) in the previous step - for example, `Okta_AtlanSSO_role`.
3. On the newly created role page, to the right of _Permission policies_, click **Add permissions**, and then from the dropdown, click **Create inline policy**.
4. On the _Create policy_ page, you will need to assign the following permissions for Redshift - `GetClusterCredentials`, `JoinGroup`, and `CreateClusterUser`. Repeat the steps below to assign each permission:
 1. For _Specify permissions_, under _Select a service_, search for and select **Redshift**. Under _Redshift_, enter the following details:
 1. For _Allowed actions_, search for and select a permission - for example, `GetClusterCredentials`.
 2. For _Resources_, click **All**.
 3. Click **Next** to proceed.
 2. For _Review and create_, under _Policy name_, enter a name for the newly created policy - for example, `Okta_AtlanSSO_rolepolicy`.

### Retrieve identity provider and role ARN

Once you have configured Okta as the identity provider and created a role in AWS, you will need the identity provider ARN and role ARN for further configuration in Okta.

To retrieve the identity provider and role ARN, within AWS:

1. Sign in to the AWS Management Console and open the AWS Identity and Access Management (IAM) console.

2. From the left menu of your AWS Identity and Access Management (IAM) console:
 1. Click **Identity providers** and then select the [identity provider you created](https://docs.atlan.com/llms/connectors/amazon-redshift/enable-sso-for-amazon-redshift/llms.txt):
 1. On the identity provider page, under _ARN_, click the clipboard icon to copy the identity provider ARN value and store it in a secure location.
 2. Click **Roles** and then select the [role you created](https://docs.atlan.com/llms/connectors/amazon-redshift/enable-sso-for-amazon-redshift/llms.txt):
 1. On the role page, under _ARN_, click the clipboard icon to copy the role ARN value and store it in a secure location.

## Configure the client application in Okta

:::warning Who can do this?
 You will need your Okta administrator to complete these steps - you may not have access yourself. You will also need inputs and approval from your AWS administrator.
:::

You will need the identity provider ARN and role ARN from AWS for further configuration in Okta.

To further configure the client application in Okta:

1. Log in to your Okta _Admin Console_.
2. From the left menu of the _Admin Console_, click **Applications**.
3. Under _Applications_, select the client application you created in Okta.
4. On your new app page, click the **Sign On** tab.
5. On the _Sign On_ page, next to _Settings_, click **Edit**.
6. Navigate to the _Advanced Sign-on Settings_ section and enter the following details:
 1. For _IdP ARN and Role ARN_, enter the identity provider ARN and role ARN as comma-separated values - for example, `arn:aws:iam::403973984390:role/oktaAtlan_SSO`, `arn:aws:iam::403976283490:saml-provider/oktaAtlan_SSO_role`.
 2. For _Allowed DB Groups (Redshift)_, enter the names of the Okta groups that should be provided access to Amazon Redshift.
 3. Click **Save** to confirm.
7. On your new app page, click the **General** tab and navigate to the _App Embed Link_ section.
 1. Under _Embed Link_, copy the link - for example, `https://**<example>.okta.com**/home/amazon_aws_redshift/**0oa78lx856GcTMDsa697/aln1dkqcfra0piaWa0g**` - and store the IdP host name and app ID in a secure location to use for [configuring SSO authentication in Atlan](https://docs.atlan.com/llms/connectors/amazon-redshift/enable-sso-for-amazon-redshift/llms.txt). For example:
 - IdP host name: `<example>.okta.com`
 - App ID: `0oa78lx856GcTMDsa697/aln1dkqcfra0piaWa0g`

## Configure SSO authentication in Atlan

:::warning Who can do this?
 You will need to be a [connection admin](https://docs.atlan.com/llms/governance/access-control/what-are-purposes/llms.txt) in Atlan to complete these steps. You will also need inputs and approval from your Okta and AWS administrators.
:::

Once you have configured Okta and AWS, you can enable SSO authentication for your Amazon Redshift users to [query data](https://docs.atlan.com/llms/governance/access-control/authenticate-sso-credentials-to-query-data/llms.txt) and [view sample data](https://docs.atlan.com/llms/governance/access-control/authenticate-sso-credentials-to-query-data/llms.txt) in Atlan.

To configure Okta SSO on a Amazon Redshift connection, from Atlan:

1. From the left menu of any screen, click **Assets**.
2. From the _Assets_ page, click the **Connector** filter, and from the dropdown, select **Redshift**.
3. From the pills below the search bar at the top of the screen, click **Connection**.
4. From the list of results, select an Amazon Redshift connection to enable SSO authentication.
5. From the sidebar on the right, next to _Connection settings_, click **Edit**.
6. In the _Connection settings_ dialog:
 - Under _Allow query_, for _Authentication type_, click **Okta authentication** to enforce SSO credentials for [querying data](https://docs.atlan.com/llms/governance/access-control/authenticate-sso-credentials-to-query-data/llms.txt):
 - For _SSO authentication_, enter the following details:
 1. For _IDP host_, enter the [IdP host name you copied from Okta](https://docs.atlan.com/llms/connectors/amazon-redshift/enable-sso-for-amazon-redshift/llms.txt).
 2. For _App ID_, enter the [app ID you copied from Okta](https://docs.atlan.com/llms/connectors/amazon-redshift/enable-sso-for-amazon-redshift/llms.txt).
 3. For _AWS Role ARN_, enter the [role ARN retrieved from AWS](https://docs.atlan.com/llms/connectors/amazon-redshift/enable-sso-for-amazon-redshift/llms.txt).
 - Under _Display sample data_, for _Source preview_, click **Okta authentication** to enforce SSO credentials for [viewing sample data](https://docs.atlan.com/llms/governance/access-control/authenticate-sso-credentials-to-query-data/llms.txt):
 - If SSO authentication is enabled for querying data, the same connection details will be reused for viewing sample data.
 - If a different authentication method is enabled for querying data, enter the [IdP host name and app ID you copied from Okta](https://docs.atlan.com/llms/connectors/amazon-redshift/enable-sso-for-amazon-redshift/llms.txt) and [role ARN retrieved from AWS](https://docs.atlan.com/llms/connectors/amazon-redshift/enable-sso-for-amazon-redshift/llms.txt).
7. (Optional) Toggle on **Enable data policies created at source to apply for querying in Atlan** to apply any data policies and user permissions at source to querying data and viewing sample data in Atlan. If toggled on, any existing [data policies](https://docs.atlan.com/llms/governance/access-control/what-are-purposes/llms.txt) on the connection in Atlan will be deactivated and creation of new data policies will be disabled.
8. At the bottom right of the _Connection settings_ dialog, click **Update**.

Your users will now be able to [run queries](https://docs.atlan.com/llms/governance/access-control/authenticate-sso-credentials-to-query-data/llms.txt) and [view sample data](https://docs.atlan.com/llms/governance/access-control/authenticate-sso-credentials-to-query-data/llms.txt) using their Okta SSO credentials! 🎉

---