Skip to content

Commit ab6eb56

Browse files
karenc-bqkarenc-bq
authored
fix: use separate parameters for AWS auth and federated auth (#213)
1 parent 37411d4 commit ab6eb56

File tree

9 files changed

+51
-33
lines changed

9 files changed

+51
-33
lines changed

‎docs/images/sample_okta_dsn.png

81.3 KB
Loading

‎docs/using-the-aws-driver/OktaAuthentication.md

+5-5
Original file line numberDiff line numberDiff line change
@@ -34,12 +34,12 @@ When a user wants access to a resource, it authenticates with the IdP. From this
3434
| `APP_ID` | Yes | The Amazon Web Services (AWS) app [configured](https://help.okta.com/en-us/content/topics/deploymentguides/aws/aws-configure-aws-app.htm) on Okta. | `null` | `ec2amaz-ab3cdef.example.com` |
3535
| `IAM_ROLE_ARN` | Yes | The ARN of the IAM Role that is to be assumed to access AWS Aurora. | `null` | `arn:aws:iam::123456789012:role/adfs_example_iam_role` |
3636
| `IAM_IDP_ARN` | Yes | The ARN of the Identity Provider. | `null` | `arn:aws:iam::123456789012:saml-provider/adfs_example` |
37-
| `AWS_REGION` | Yes | The AWS region where the identity provider is located. | `null` | `us-east-2` |
37+
| `FED_AWS_REGION` | Yes | The AWS region where the identity provider is located. | `null` | `us-east-2` |
3838
| `USERNAME` | Yes | The Username must be set to the [IAM database user](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.html). | `null` | `jane_doe` |
39-
| `IDP_PORT` | No | The port that the host for the authentication service listens at. | `null` | `443` |
40-
| `IAM_HOST` | No | Overrides the host used to generate the authentication token. This is useful when you are connecting using a custom endpoint, since authentication tokens need to be generated using the RDS/Aurora endpoints. | `null` | `database.cluster-hash.region.rds.amazonaws.com` |
41-
| `IAM_DEFAULT_PORT` | No | This property overrides the default port that is used to generate the authentication token. The default port is the default MySQL port. | `3306` | `1234` |
42-
| `IAM_TOKEN_EXPIRATION` | No | Overrides the default IAM token cache expiration in seconds. | `900` | `123` |
39+
| `IDP_PORT` | No | The port that the host for the authentication service listens at. | `443` | `443` |
40+
| `FED_AUTH_HOST` | No | Overrides the host used to generate the authentication token. This is useful when you are connecting using a custom endpoint, since authentication tokens need to be generated using the RDS/Aurora endpoints. | `null` | `database.cluster-hash.region.rds.amazonaws.com` |
41+
| `FED_AUTH_DEFAULT_PORT` | No | This property overrides the default port that is used to generate the authentication token. The default port is the default MySQL port. | `3306` | `1234` |
42+
| `FED_AUTH_EXPIRATION_TIME`| No | Overrides the default IAM token cache expiration in seconds. | `900` | `123` |
4343
| `CLIENT_SOCKET_TIMEOUT` | No | The read and write timeout value in seconds for the HttpClient used during the Okta authentication workflow. | `60` | `30` |
4444
| `CLIENT_CONNECT_TIMEOUT` | No | The connect timeout value in seconds for the HttpClient used during the Okta authentication workflow. | `60` | `30` |
4545
| `ENABLE_SSL` | No | Set to false to disable server certificate verification. Useful during local development when testing locally hosted servers using self-signed certificates. Not recommended for production. | `true` | `false` |

‎driver/iam_proxy.cc

+2-5
Original file line numberDiff line numberDiff line change
@@ -39,11 +39,8 @@ IAM_PROXY::IAM_PROXY(DBC* dbc, DataSource* ds) : IAM_PROXY(dbc, ds, nullptr) {};
3939

4040
IAM_PROXY::IAM_PROXY(DBC* dbc, DataSource* ds, CONNECTION_PROXY* next_proxy) : CONNECTION_PROXY(dbc, ds) {
4141
this->next_proxy = next_proxy;
42-
if (ds->opt_AUTH_REGION) {
43-
this->auth_util = std::make_shared<AUTH_UTIL>((const char*)ds->opt_AUTH_REGION);
44-
} else {
45-
this->auth_util = std::make_shared<AUTH_UTIL>();
46-
}
42+
const char* region = ds->opt_AUTH_REGION ? static_cast<const char*>(ds->opt_AUTH_REGION) : Aws::Region::US_EAST_1;
43+
this->auth_util = std::make_shared<AUTH_UTIL>(region);
4744
}
4845

4946
IAM_PROXY::~IAM_PROXY() {

‎driver/okta_proxy.cc

+7-5
Original file line numberDiff line numberDiff line change
@@ -42,11 +42,13 @@ OKTA_PROXY::OKTA_PROXY(DBC* dbc, DataSource* ds) : OKTA_PROXY(dbc, ds, nullptr)
4242

4343
OKTA_PROXY::OKTA_PROXY(DBC* dbc, DataSource* ds, CONNECTION_PROXY* next_proxy) : CONNECTION_PROXY(dbc, ds) {
4444
this->next_proxy = next_proxy;
45-
const std::string idp_host{static_cast<const char*>(ds->opt_IDP_ENDPOINT)};
45+
std::string host{static_cast<const char*>(ds->opt_IDP_ENDPOINT)};
46+
host += ":" + std::to_string(ds->opt_IDP_PORT);
47+
4648
const int client_connect_timeout = ds->opt_CLIENT_CONNECT_TIMEOUT;
4749
const int client_socket_timeout = ds->opt_CLIENT_SOCKET_TIMEOUT;
4850
const bool enable_ssl = ds->opt_ENABLE_SSL;
49-
this->saml_util = std::make_shared<OKTA_SAML_UTIL>(idp_host, client_connect_timeout, client_socket_timeout, enable_ssl);
51+
this->saml_util = std::make_shared<OKTA_SAML_UTIL>(host, client_connect_timeout, client_socket_timeout, enable_ssl);
5052
}
5153

5254
bool OKTA_PROXY::connect(const char* host, const char* user, const char* password, const char* database,
@@ -57,7 +59,7 @@ bool OKTA_PROXY::connect(const char* host, const char* user, const char* passwor
5759
}
5860

5961
bool OKTA_PROXY::invoke_func_with_fed_credentials(std::function<bool(const char*)> func) {
60-
const char* region = ds->opt_AUTH_REGION ? static_cast<const char*>(ds->opt_AUTH_REGION) : Aws::Region::US_EAST_1;
62+
const char* region = ds->opt_FED_AUTH_REGION ? static_cast<const char*>(ds->opt_FED_AUTH_REGION) : Aws::Region::US_EAST_1;
6163
std::string assertion;
6264
try {
6365
assertion = this->saml_util->get_saml_assertion(ds);
@@ -74,8 +76,8 @@ bool OKTA_PROXY::invoke_func_with_fed_credentials(std::function<bool(const char*
7476
this->auth_util = std::make_shared<AUTH_UTIL>(region, credentials);
7577

7678
const char* AUTH_HOST =
77-
ds->opt_AUTH_HOST ? static_cast<const char*>(ds->opt_AUTH_HOST) : static_cast<const char*>(ds->opt_SERVER);
78-
int auth_port = ds->opt_AUTH_PORT;
79+
ds->opt_FED_AUTH_HOST ? static_cast<const char*>(ds->opt_FED_AUTH_HOST) : static_cast<const char*>(ds->opt_SERVER);
80+
int auth_port = ds->opt_FED_AUTH_PORT;
7981
if (auth_port == UNDEFINED_PORT) {
8082
// Use regular port if user does not provide an alternative port for AWS authentication
8183
auth_port = ds->opt_PORT;

‎setupgui/callbacks.cc

+11-8
Original file line numberDiff line numberDiff line change
@@ -338,10 +338,13 @@ void syncTabsData(HWND hwnd, DataSource *params)
338338
GET_STRING_TAB(FED_AUTH_TAB, IAM_ROLE_ARN);
339339
GET_STRING_TAB(FED_AUTH_TAB, IAM_IDP_ARN);
340340
GET_UNSIGNED_TAB(FED_AUTH_TAB, IDP_PORT);
341-
GET_STRING_TAB(FED_AUTH_TAB, AUTH_REGION);
342-
GET_STRING_TAB(FED_AUTH_TAB, AUTH_HOST);
343-
GET_UNSIGNED_TAB(FED_AUTH_TAB, AUTH_PORT);
344-
GET_UNSIGNED_TAB(FED_AUTH_TAB, AUTH_EXPIRATION);
341+
GET_STRING_TAB(FED_AUTH_TAB, FED_AUTH_REGION);
342+
GET_STRING_TAB(FED_AUTH_TAB, FED_AUTH_HOST);
343+
GET_UNSIGNED_TAB(FED_AUTH_TAB, FED_AUTH_PORT);
344+
GET_UNSIGNED_TAB(FED_AUTH_TAB, FED_AUTH_EXPIRATION);
345+
GET_UNSIGNED_TAB(FED_AUTH_TAB, CLIENT_CONNECT_TIMEOUT);
346+
GET_UNSIGNED_TAB(FED_AUTH_TAB, CLIENT_SOCKET_TIMEOUT);
347+
GET_BOOL_TAB(FED_AUTH_TAB, ENABLE_SSL);
345348

346349
/* 5 - Failover */
347350
GET_BOOL_TAB(FAILOVER_TAB, ENABLE_CLUSTER_FAILOVER);
@@ -490,10 +493,10 @@ void syncTabs(HWND hwnd, DataSource *params)
490493
SET_STRING_TAB(FED_AUTH_TAB, IAM_ROLE_ARN);
491494
SET_STRING_TAB(FED_AUTH_TAB, IAM_IDP_ARN);
492495
SET_UNSIGNED_TAB(FED_AUTH_TAB, IDP_PORT);
493-
SET_STRING_TAB(FED_AUTH_TAB, AUTH_REGION);
494-
SET_STRING_TAB(FED_AUTH_TAB, AUTH_HOST);
495-
SET_UNSIGNED_TAB(FED_AUTH_TAB, AUTH_PORT);
496-
SET_UNSIGNED_TAB(FED_AUTH_TAB, AUTH_EXPIRATION);
496+
SET_STRING_TAB(FED_AUTH_TAB, FED_AUTH_REGION);
497+
SET_STRING_TAB(FED_AUTH_TAB, FED_AUTH_HOST);
498+
SET_UNSIGNED_TAB(FED_AUTH_TAB, FED_AUTH_PORT);
499+
SET_UNSIGNED_TAB(FED_AUTH_TAB, FED_AUTH_EXPIRATION);
497500
SET_UNSIGNED_TAB(FED_AUTH_TAB, CLIENT_CONNECT_TIMEOUT);
498501
SET_UNSIGNED_TAB(FED_AUTH_TAB, CLIENT_SOCKET_TIMEOUT);
499502
SET_BOOL_TAB(FED_AUTH_TAB, ENABLE_SSL);

‎setupgui/windows/odbcdialogparams.rc

+7-7
Original file line numberDiff line numberDiff line change
@@ -238,13 +238,13 @@ BEGIN
238238
LTEXT "IDP Port:",IDC_STATIC,207,125,36,10
239239
EDITTEXT IDC_EDIT_IDP_PORT,243,124,51,12,ES_AUTOHSCROLL | ES_NUMBER
240240
RTEXT "AWS Region:",IDC_STATIC,3,126,58,18
241-
EDITTEXT IDC_EDIT_AUTH_REGION,65,125,136,12,ES_AUTOHSCROLL
242-
RTEXT "IAM Host:",IDC_STATIC,3,145,58,18
243-
EDITTEXT IDC_EDIT_AUTH_HOST,65,144,136,12,ES_AUTOHSCROLL
244-
LTEXT "IAM Port:",IDC_STATIC,207,144,36,18
245-
EDITTEXT IDC_EDIT_AUTH_PORT,244,143,51,12,ES_AUTOHSCROLL | ES_NUMBER
246-
RTEXT "IAM Expire Time:",IDC_STATIC,3,163,58,18
247-
EDITTEXT IDC_EDIT_AUTH_EXPIRATION,65,162,136,12,ES_AUTOHSCROLL | ES_NUMBER
241+
EDITTEXT IDC_EDIT_FED_AUTH_REGION,65,125,136,12,ES_AUTOHSCROLL
242+
RTEXT "Auth Host:",IDC_STATIC,3,145,58,18
243+
EDITTEXT IDC_EDIT_FED_AUTH_HOST,65,144,136,12,ES_AUTOHSCROLL
244+
LTEXT "Auth Port:",IDC_STATIC,207,144,36,18
245+
EDITTEXT IDC_EDIT_FED_AUTH_PORT,244,143,51,12,ES_AUTOHSCROLL | ES_NUMBER
246+
RTEXT "Auth Expire Time:",IDC_STATIC,3,163,58,18
247+
EDITTEXT IDC_EDIT_FED_AUTH_EXPIRATION,65,162,136,12,ES_AUTOHSCROLL | ES_NUMBER
248248
LTEXT "Client Connect Timeout:",IDC_STATIC,207,47,86,10
249249
EDITTEXT IDC_EDIT_CLIENT_CONNECT_TIMEOUT,207,59,51,12,ES_AUTOHSCROLL | ES_NUMBER
250250
LTEXT "Client Socket Timeout:",IDC_STATIC,207,76,75,10

‎setupgui/windows/resource.h

+4
Original file line numberDiff line numberDiff line change
@@ -195,6 +195,10 @@
195195
#define IDC_EDIT_CLIENT_CONNECT_TIMEOUT 11028
196196
#define IDC_EDIT_CLIENT_SOCKET_TIMEOUT 11029
197197
#define IDC_CHECK_ENABLE_SSL 11030
198+
#define IDC_EDIT_FED_AUTH_REGION 11031
199+
#define IDC_EDIT_FED_AUTH_HOST 11032
200+
#define IDC_EDIT_FED_AUTH_PORT 11033
201+
#define IDC_EDIT_FED_AUTH_EXPIRATION 11034
198202
#define MYSQL_ADMIN_PORT 33062
199203
#define IDC_STATIC -1
200204

‎util/installer.cc

+8
Original file line numberDiff line numberDiff line change
@@ -256,6 +256,10 @@ static SQLWCHAR W_IDP_PORT[] = { 'I', 'D', 'P', '_', 'P', 'O', 'R', 'T', 0 };
256256
static SQLWCHAR W_CLIENT_CONNECT_TIMEOUT[] = {'C', 'L', 'I', 'E', 'N', 'T', '_', 'C', 'O', 'N', 'N', 'E', 'C', 'T', '_', 'T', 'I', 'M', 'E', 'O', 'U', 'T', 0};
257257
static SQLWCHAR W_CLIENT_SOCKET_TIMEOUT[] = {'C', 'L', 'I', 'E', 'N', 'T', '_', 'S', 'O', 'C', 'K', 'E', 'T', '_', 'T', 'I', 'M', 'E', 'O', 'U', 'T', 0};
258258
static SQLWCHAR W_ENABLE_SSL[] = {'E', 'N', 'A', 'B', 'L', 'E', '_', 'S', 'S', 'L', 0};
259+
static SQLWCHAR W_FED_AUTH_REGION[] = { 'F', 'E', 'D', '_', 'A', 'W', 'S', '_', 'R', 'E', 'G', 'I', 'O', 'N', 0 };
260+
static SQLWCHAR W_FED_AUTH_HOST[] = { 'F', 'E', 'D', '_','A', 'U', 'T', 'H', '_', 'H', 'O', 'S', 'T', 0 };
261+
static SQLWCHAR W_FED_AUTH_PORT[] = { 'F', 'E', 'D', '_','A', 'U', 'T', 'H', '_', 'P', 'O', 'R', 'T', 0 };
262+
static SQLWCHAR W_FED_AUTH_EXPIRATION[] = { 'F', 'E', 'D', '_', 'A', 'U', 'T', 'H', '_', 'E', 'X', 'P', 'I', 'R', 'A', 'T', 'I', 'O', 'N', '_', 'T', 'I', 'M', 'E', 0 };
259263

260264
/* Failover */
261265
static SQLWCHAR W_ENABLE_CLUSTER_FAILOVER[] = { 'E', 'N', 'A', 'B', 'L', 'E', '_', 'C', 'L', 'U', 'S', 'T', 'E', 'R', '_', 'F', 'A', 'I', 'L', 'O', 'V', 'E', 'R', 0 };
@@ -325,6 +329,7 @@ SQLWCHAR *dsnparams[]= {W_DSN, W_DRIVER, W_DESCRIPTION, W_SERVER,
325329
/* FED Auth*/
326330
W_IDP_USERNAME, W_IDP_PASSWORD, W_IDP_ENDPOINT, W_IDP_PORT, W_APP_ID, W_IAM_ROLE_ARN, W_IAM_IDP_ARN,
327331
W_CLIENT_CONNECT_TIMEOUT, W_CLIENT_SOCKET_TIMEOUT, W_ENABLE_SSL,
332+
W_FED_AUTH_REGION, W_FED_AUTH_REGION, W_FED_AUTH_PORT, W_FED_AUTH_EXPIRATION,
328333
/* Failover */
329334
W_ENABLE_CLUSTER_FAILOVER, W_FAILOVER_MODE,
330335
W_GATHER_PERF_METRICS, W_GATHER_PERF_METRICS_PER_INSTANCE,
@@ -1057,6 +1062,9 @@ void DataSource::reset() {
10571062

10581063
this->opt_AUTH_PORT.set_default(opt_PORT);
10591064
this->opt_AUTH_EXPIRATION.set_default(900); // 15 minutes
1065+
this->opt_FED_AUTH_PORT.set_default(opt_PORT);
1066+
this->opt_FED_AUTH_EXPIRATION.set_default(900); // 15 minutes
1067+
this->opt_IDP_PORT.set_default(443);
10601068
this->opt_CLIENT_CONNECT_TIMEOUT.set_default(60);
10611069
this->opt_CLIENT_SOCKET_TIMEOUT.set_default(60);
10621070
this->opt_ENABLE_SSL.set_default(true);

‎util/installer.h

+7-3
Original file line numberDiff line numberDiff line change
@@ -317,17 +317,21 @@ unsigned int get_network_timeout(unsigned int seconds);
317317

318318
#define FED_AUTH_STR_OPTIONS_LIST(X) \
319319
X(FED_AUTH_MODE) \
320-
X(IDP_USERNAME) \
320+
X(IDP_USERNAME) \
321321
X(IDP_PASSWORD) \
322322
X(IDP_ENDPOINT) \
323323
X(IAM_ROLE_ARN) \
324324
X(IAM_IDP_ARN) \
325-
X(APP_ID)
325+
X(APP_ID) \
326+
X(FED_AUTH_HOST) \
327+
X(FED_AUTH_REGION)
326328

327329
#define FED_AUTH_INT_OPTIONS_LIST(X) \
328330
X(IDP_PORT) \
329331
X(CLIENT_SOCKET_TIMEOUT) \
330-
X(CLIENT_CONNECT_TIMEOUT)
332+
X(CLIENT_CONNECT_TIMEOUT) \
333+
X(FED_AUTH_PORT) \
334+
X(FED_AUTH_EXPIRATION)
331335

332336
#define FED_AUTH_BOOL_OPTIONS_LIST(X) \
333337
X(ENABLE_SSL)

0 commit comments

Comments
 (0)