Skip to content

Commit 34c71d9

Browse files
crystall-bitquillcrystall-bitquill
committed
feat: enable OTP and Push MFA for Okta
1 parent 65af675 commit 34c71d9

24 files changed

+1788
-64
lines changed

‎docs/using-the-aws-odbc-wrapper/plugins/okta-authentication-plugin.md‎

Lines changed: 24 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -14,29 +14,33 @@ When a user wants access to a resource, it authenticates with the IdP. From this
1414

1515
1. Follow steps in [Enable AWS IAM Database Authentication](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.Enabling.html) to setup IAM authentication.
1616
2. Configure Okta as the AWS identity provider following [Okta's official documentation](https://help.okta.com/en-us/content/topics/deploymentguides/aws/aws-deployment.htm)
17+
3. (Optional) Enable MFA. MFA through Okta Verify is supported for the Push and OTP methods. Please ensure the authentication policies and/or global session policies have been configured to use MFA.
1718

1819
### Connection String / DSN Configuration for Okta Authentication Plugin Support
1920

20-
| Field | Connection Option Key | Value | Default Value | Sample Value |
21-
|-----------------------|------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------|--------------------------------------------------------|
22-
| Authentication Type | `RDS_AUTH_TYPE` | Must be `OKTA`. | `database` | `OKTA` |
23-
| Server | `SERVER` | Database instance server host. | nil | `database.us-east-1-rds.amazon.com` |
24-
| Port | `PORT` | Port that the database is listening on. | nil | 5432 |
25-
| User Name | `UID` | Database user name for IAM authentication. | nil | `iam_user` |
26-
| IAM Host | `IAM_HOST` | The endpoint used to generate the authentication token. This is only required if you are connecting using custom endpoints such as an IP address. | nil | `database.us-east-1-rds.amazon.com` |
27-
| Region | `REGION` | The region of the database for IAM authentication. | `us-east-1` | `us-east-1` |
28-
| Database | `DATABASE` | Default database that a user will work on. | nil | `my_database` |
29-
| Token Expiration | `TOKEN_EXPIRATION` | Token expiration in seconds, supported max value is 900. | 900 | 900 |
30-
| IdP Endpoint | `IDP_ENDPOINT` | The ADFS host that is used to authenticate with. | nil | `my-adfs-host.com` |
31-
| IdP Port | `IDP_PORT` | The ADFS host port. | 443 | 443 |
32-
| IdP User Name | `IDP_USERNAME` | The user name for the IdP Endpoint server. | nil | `user@email.com` |
33-
| IdP Password | `IDP_PASSWORD` | The IdP user's password. | nil | `my_password_123` |
34-
| Role ARN | `IDP_ROLE_ARN` | The ARN of the IAM Role that is to be assumed for database access. | nil | `arn:aws:iam::123412341234:role/ADFS-SAML-Assume` |
35-
| IdP SAML Provider ARN | `IDP_SAML_ARN` | The ARN of the Identity Provider. | nil | `arn:aws:iam::123412341234:saml-provider/ADFS-AWS-IAM` |
36-
| HTTP Socket Timeout | `HTTP_SOCKET_TIMEOUT` | The socket timeout value in milliseconds for the HttpClient reading. | 3000 | 3000 |
37-
| HTTP Connect Timeout | `HTTP_CONNECT_TIMEOUT` | The connect timeout value in milliseconds for the HttpClient. | 5000 | 5000 |
38-
| App ID | `APP_ID` | The application ID for AWS configured on. | nil | `my-app-id` |
39-
| Extra URL Encode | `EXTRA_URL_ENCODE` | Generated tokens can have URL encoding prefix duplication for scenarios where underlying drivers automatically decode the URL before passing to the database for connections. | `0` | `1` |
21+
| Field | Connection Option Key | Value | Default Value | Sample Value |
22+
|-----------------------|------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------|--------------------------------------------------------|
23+
| Authentication Type | `RDS_AUTH_TYPE` | Must be `OKTA`. | `database` | `OKTA` |
24+
| Server | `SERVER` | Database instance server host. | nil | `database.us-east-1-rds.amazon.com` |
25+
| Port | `PORT` | Port that the database is listening on. | nil | `5432` |
26+
| User Name | `UID` | Database user name for IAM authentication. | nil | `iam_user` |
27+
| IAM Host | `IAM_HOST` | The endpoint used to generate the authentication token. This is only required if you are connecting using custom endpoints such as an IP address. | nil | `database.us-east-1-rds.amazon.com` |
28+
| Region | `REGION` | The region of the database for IAM authentication. | `us-east-1` | `us-east-1` |
29+
| Database | `DATABASE` | Default database that a user will work on. | nil | `my_database` |
30+
| Token Expiration | `TOKEN_EXPIRATION` | Token expiration in seconds, supported max value is 900. | `900` | `900` |
31+
| IdP Endpoint | `IDP_ENDPOINT` | The ADFS host that is used to authenticate with. | nil | `my-adfs-host.com` |
32+
| IdP Port | `IDP_PORT` | The ADFS host port. | `443` | `443` |
33+
| IdP User Name | `IDP_USERNAME` | The user name for the IdP Endpoint server. | nil | `user@email.com` |
34+
| IdP Password | `IDP_PASSWORD` | The IdP user's password. | nil | `my_password_123` |
35+
| Role ARN | `IDP_ROLE_ARN` | The ARN of the IAM Role that is to be assumed for database access. | nil | `arn:aws:iam::123412341234:role/ADFS-SAML-Assume` |
36+
| IdP SAML Provider ARN | `IDP_SAML_ARN` | The ARN of the Identity Provider. | nil | `arn:aws:iam::123412341234:saml-provider/ADFS-AWS-IAM` |
37+
| HTTP Socket Timeout | `HTTP_SOCKET_TIMEOUT` | The socket timeout value in milliseconds for the HttpClient reading. | `3000` | `3000` |
38+
| HTTP Connect Timeout | `HTTP_CONNECT_TIMEOUT` | The connect timeout value in milliseconds for the HttpClient. | `5000` | `5000` |
39+
| App ID | `APP_ID` | The application ID for AWS configured on. | nil | `my-app-id` |
40+
| Extra URL Encode | `EXTRA_URL_ENCODE` | Generated tokens can have URL encoding prefix duplication for scenarios where underlying drivers automatically decode the URL before passing to the database for connections. | `0` | `1` |
41+
| MFA Type | `MFA_TYPE` | The MFA type the user specifies. The available options are: `TOTP`, `PUSH`. **Note**: the `TOTP` type requires a web browser to be used. | nil | `TOTP` |
42+
| MFA Port | `MFA_PORT` | The port used to connect to `127.0.0.1` to provide the one time code when using TOTP as the MFA Type. | `8080` | `8000` |
43+
| MFA Timeout | `MFA_TIMEOUT` | The time in seconds to complete the MFA challenge before the connection fails. | `60` | `30` |
4044

4145
> [!WARNING]\
4246
> Using IAM Authentication, connections to the database must have SSL enabled. Please refer to the underlying driver's specifications to enable this.

‎driver/CMakeLists.txt‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -74,6 +74,17 @@ set(INC
7474
${CMAKE_CURRENT_SOURCE_DIR}/host_info.h
7575
${CMAKE_CURRENT_SOURCE_DIR}/odbcapi.h
7676
${CMAKE_CURRENT_SOURCE_DIR}/odbcapi_rds_helper.h
77+
78+
# Webserver
79+
${CMAKE_CURRENT_SOURCE_DIR}/plugin/federated/http/AddrInformation.h
80+
${CMAKE_CURRENT_SOURCE_DIR}/plugin/federated/http/HtmlResponse.h
81+
${CMAKE_CURRENT_SOURCE_DIR}/plugin/federated/http/Parser.h
82+
${CMAKE_CURRENT_SOURCE_DIR}/plugin/federated/http/Selector.h
83+
${CMAKE_CURRENT_SOURCE_DIR}/plugin/federated/http/Socket.h
84+
${CMAKE_CURRENT_SOURCE_DIR}/plugin/federated/http/SocketStream.h
85+
${CMAKE_CURRENT_SOURCE_DIR}/plugin/federated/http/SocketSupport.h
86+
${CMAKE_CURRENT_SOURCE_DIR}/plugin/federated/http/WEBServer.h
87+
${CMAKE_CURRENT_SOURCE_DIR}/plugin/federated/http/WEBServer_utils.h
7788
)
7889

7990
set(SRC
@@ -116,6 +127,13 @@ set(SRC
116127
${CMAKE_CURRENT_SOURCE_DIR}/host_info.cpp
117128
${CMAKE_CURRENT_SOURCE_DIR}/odbcapi_common.cpp
118129
${CMAKE_CURRENT_SOURCE_DIR}/odbcapi_rds_helper.cpp
130+
131+
# Webserver
132+
${CMAKE_CURRENT_SOURCE_DIR}/plugin/federated/http/AddrInformation.cpp
133+
${CMAKE_CURRENT_SOURCE_DIR}/plugin/federated/http/Parser.cpp
134+
${CMAKE_CURRENT_SOURCE_DIR}/plugin/federated/http/Selector.cpp
135+
${CMAKE_CURRENT_SOURCE_DIR}/plugin/federated/http/Socket.cpp
136+
${CMAKE_CURRENT_SOURCE_DIR}/plugin/federated/http/WEBServer.cpp
119137
)
120138

121139
# GUI

0 commit comments

Comments
 (0)