使用 IAM Identity Center 從 Tableau 單一登入 Amazon Redshift

本部落格文章由 Salesforce 的 Sid Wray 和 Jake Koskela 以及 Tableau 的 Adiascar Cisneros 共同撰寫。 Amazon Redshift 是一個快速、可擴展的雲端資料倉儲，旨在為任何規模的工作負載提供服務。使用Amazon Redshift 作為資料倉儲，您可以使用複雜的查詢最佳化來執行複雜的查詢，以快速將結果交付給Tableau，Tableau 為分析師提供了一套全面的功能和連接選項，以便在整個企業內高效地準備、發現和分享見解。對於想要使用單一登入功能將 Amazon Redshift 與 Tableau 整合的客戶，我們引入了 AWS IAM Identity Center 整合來無縫實施驗證和授權。

Amazon Redshift is a fast, fully managed, petabyte-scale cloud data warehouse service that makes it simple and cost-effective to analyze all your data using standard SQL and advanced analytics capabilities. It’s designed to handle massive volumes of structured and semi-structured data, and it scales up or down quickly to meet your changing needs.

Amazon Redshift 是一種快速、完全託管的 PB 級雲端資料倉儲服務，可讓您使用標準 SQL 和進階分析功能輕鬆且經濟高效地分析所有資料。它旨在處理大量結構化和半結構化數據，並且可以快速擴展或縮小以滿足您不斷變化的需求。

With Amazon Redshift as your data warehouse, you can run complex queries using sophisticated query optimization to quickly deliver results to Tableau, which offers a comprehensive set of capabilities and connectivity options for analysts to efficiently prepare, discover, and share insights across the enterprise. For customers who want to integrate Amazon Redshift with Tableau using single sign-on capabilities, we introduced AWS IAM Identity Center integration to seamlessly implement authentication and authorization.

使用Amazon Redshift 作為資料倉儲，您可以使用複雜的查詢最佳化來執行複雜的查詢，以快速將結果交付給Tableau，Tableau 為分析師提供了一套全面的功能和連接選項，以便在整個企業內高效地準備、發現和分享見解。對於想要使用單一登入功能將 Amazon Redshift 與 Tableau 整合的客戶，我們引入了 AWS IAM Identity Center 整合來無縫實施驗證和授權。

IAM Identity Center provides capabilities to centrally manage single sign-on access to AWS accounts and applications. Redshift now integrates with IAM Identity Center, and supports trusted identity propagation, making it possible to integrate with third-party identity providers (IdP) such as Microsoft Entra ID (Azure AD), Okta, Ping, and OneLogin. This integration positions Amazon Redshift as an IAM Identity Center-managed application, enabling you to use database role-based access control on your data warehouse for enhanced security. Role-based access control allows you to apply fine grained access control using row level, column level, and dynamic data masking in your data warehouse.

IAM Identity Center 提供集中管理對 AWS 帳戶和應用程式的單一登入存取的功能。 Redshift 現在與 IAM Identity Center 集成，並支援可信任身分傳播，因此可與 Microsoft Entra ID (Azure AD)、Okta、Ping 和 OneLogin 等第三方身分提供者 (IdP) 整合。此整合將 Amazon Redshift 定位為 IAM Identity Center 管理的應用程序，使您能夠在資料倉儲上使用基於資料庫角色的存取控制來增強安全性。基於角色的存取控制可讓您在資料倉儲中使用行級別、列級和動態資料屏蔽來套用細粒度存取控制。

AWS and Tableau have collaborated to enable single sign-on support for accessing Amazon Redshift from Tableau. Tableau now supports single sign-on capabilities with Amazon Redshift connector to simplify the authentication and authorization. The Tableau Desktop 2024.1 and Tableau Server 2023.3.4 releases support trusted identity propagation with IAM Identity Center. This allows users to seamlessly access Amazon Redshift data within Tableau using their external IdP credentials without needing to specify AWS Identity and Access Management (IAM) roles in Tableau. This single sign-on integration is available for Tableau Desktop, Tableau Server, and Tableau Prep.

AWS 和 Tableau 合作為從 Tableau 存取 Amazon Redshift 提供單一登入支援。 Tableau 現在支援使用 Amazon Redshift 連接器的單一登入功能，以簡化驗證和授權。 Tableau Desktop 2024.1 和 Tableau Server 2023.3.4 版本支援使用 IAM 身分中心進行可信任身分傳播。這允許使用者使用其外部 IdP 憑證無縫存取 Tableau 中的 Amazon Redshift 數據，而無需在 Tableau 中指定 AWS Identity and Access Management (IAM) 角色。此單一登入整合適用於 Tableau Desktop、Tableau Server 和 Tableau Prep。

In this post, we outline a comprehensive guide for setting up single sign-on to Amazon Redshift using integration with IAM Identity Center and Okta as the IdP. By following this guide, you’ll learn how to enable seamless single sign-on authentication to Amazon Redshift data sources directly from within Tableau Desktop, streamlining your analytics workflows and enhancing security.

在這篇文章中，我們概述了使用 IAM Identity Center 和 Okta 作為 IdP 整合來設定 Amazon Redshift 單一登入的綜合指南。透過遵循本指南，您將了解如何直接從 Tableau Desktop 內對 Amazon Redshift 資料來源啟用無縫單一登入驗證，從而簡化分析工作流程並增強安全性。

Prerequisites

先決條件

Before you begin implementing the solution, make sure that you have the following in place:

在開始實施解決方案之前，請確保您已做好以下準備：

Walkthrough

演練

In this walkthrough, you build the solution with following steps:

在本演練中，您將透過以下步驟建立解決方案：

Set up the Okta OIDC application

設定 Okta OIDC 應用程式

To create an OIDC web app in Okta, follow the instructions in this video, or use the following steps to create the wep app in Okta admin console:

要在 Okta 中建立 OIDC Web 應用程序，請按照本影片中的說明操作，或使用以下步驟在 Okta 管理控制台中建立 wep 應用程式：

Note: The Tableau Desktop redirect URLs should always use localhost. The examples below also use localhost for the Tableau Server hostname for ease of testing in a test environment. For this setup, you should also access the server at localhost in the browser. If you decide to use localhost for early testing, you will also need to configure the gateway to accept localhost using this tsm command:

注意：Tableau Desktop 重新導向 URL 應始終使用 localhost。下面的範例也使用 localhost 作為 Tableau Server 主機名，以便於在測試環境中進行測試。對於此設置，您還應該在瀏覽器中存取本地主機上的伺服器。如果您決定使用 localhost 進行早期測試，您還需要使用以下 tsm 命令設定網關以接受 localhost：

In a production environment, or Tableau Cloud, you should use the full hostname that your users will access Tableau on the web, along with https. If you already have an environment with https configured, you may skip the localhost configuration and use the full hostname from the start.

在生產環境或 Tableau Cloud 中，您應該使用使用者將在 Web 上存取 Tableau 的完整主機名稱以及 https。如果您已經設定了 https 環境，則可以跳過 localhost 設定並從一開始就使用完整主機名稱。

Set up the Okta authorization server

設定 Okta 授權伺服器

Okta allows you to create multiple custom authorization servers that you can use to protect your own resource servers. Within each authorization server you can define your own OAuth 2.0 scopes, claims, and access policies. If you have an Okta Developer Edition account, you already have a custom authorization server created for you called default.

Okta 可讓您建立多個自訂授權伺服器，您可以使用它們來保護自己的資源伺服器。在每個授權伺服器中，您可以定義自己的 OAuth 2.0 範圍、聲明和存取策略。如果您有 Okta Developer Edition 帳戶，則已經為您建立了一個名為預設的自訂授權伺服器。

For this blog post, we use the default custom authorization server. If your application has requirements such as requiring more scopes, customizing rules for when to grant scopes, or you need more authorization servers with different scopes and claims, then you can follow this guide.

對於本博文，我們使用預設的自訂授權伺服器。如果您的應用程式有諸如需要更多範圍、自訂何時授予範圍的規則等要求，或者您需要更多具有不同範圍和聲明的授權伺服器，那麼您可以遵循本指南。

Set up the Okta claims

設定 Okta 聲明

Tokens contain claims that are statements about the subject (for example: name, role, or email address). For this example, we use the default custom claim sub. Follow this guide to create claims.

令牌包含有關主題的聲明（例如：姓名、角色或電子郵件地址）。對於此範例，我們使用預設的自訂聲明子。請按照本指南建立索賠。

Setup the Okta access policies and rules

設定 Okta 存取策略和規則

Access policies are containers for rules. Each access policy applies to a particular OpenID Connect application. The rules that the policy contains define different access and refresh token lifetimes depending on the nature of the token request. In this example, you create a simple policy for all clients as shown in Figure 7 that follows. Follow this guide to create access policies and rules.

訪問策略是規則的容器。每個存取策略適用於特定的 OpenID Connect 應用程式。策略包含的規則根據令牌請求的性質定義不同的存取和刷新令牌生存期。在此範例中，您為所有客戶端建立一個簡單的策略，如下面的圖 7 所示。請按照本指南建立存取策略和規則。

Rules for access policies define token lifetimes for a given combination of grant type, user, and scope. They’re evaluated in priority order and after a matching rule is found, no other rules are evaluated. If no matching rule is found, then the authorization request fails. This example uses the role depicted in Figure 8 that follows. Follow this

存取策略規則定義給定的授權類型、使用者和範圍組合的令牌生命週期。它們按優先順序進行評估，並且在找到匹配規則後，不會評估其他規則。如果沒有找到符合的規則，則授權請求失敗。此範例使用下面圖 8 中所述的角色。按照這個