SSO profiles not supported

[thyming]

Driver version

2.1.0.9

Problem description

1. Expected behaviour: I can use a profile configured with AWS SSO to get credentials.
2. Actual behaviour: There's a vague error, but I see from the logs that it cannot read access keys.
3. Error message/stack trace:
4. Any other details that can be helpful:
   Based on AWS docs, this is expected with the redshift client version this library is using.

JDBC trace logs

Reproduction code

[Brooke-white]

Hi @thyming , could you please share the following to help us troubleshoot

1. Code snippit showing how you're establishing the connection
2. Driver logs

My apologies for the delay in response.

[thyming]

I don’t have that handy, but looking at the documentation for the aws sdk version used in the project reveals that this method of authentication is not supported.

…

On Fri, Nov 11, 2022 at 1:07 PM Brooke White ***@***.***> wrote: Hi @thyming <https://github.com/thyming> , could you please share the following to help us troubleshoot 1. Code snippit showing how you're establishing the connection 2. Driver logs My apologies for the delay in response. — Reply to this email directly, view it on GitHub <#70 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAQ5N2OEJRXGLMSOFI257XTWH2DOVANCNFSM6AAAAAARLM5U4M> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[shaohong]

@Brooke-white in the pom.xml, the driver still depends on the AWS SDK for Java 1.x. The 2.x libraries are using a different groupID like 'software.amazon.awssdk'

According to AWS documentation: https://docs.aws.amazon.com/sdkref/latest/guide/feature-sso-credentials.html
the SSO credential mechanism is only supported in AWS SDK for Java 2.x libraries.

This is also noticable if I download the all-in-one zip file from https://docs.aws.amazon.com/redshift/latest/mgmt/jdbc20-download-driver.html after extraction all the dependencies are java 1.x sdk, such as 'aws-java-sdk-core-1.12.251.jar'

[Brooke-white]

thanks for sharing this info, @shaohong. The Redshift JDBC is still using AWS SDK for Java 1.x. pinging @bhvkshah on this so we can raise this (use of AWS SDK 2.x) with the team.

[bhvkshah]

Hi @thyming , while we will not be pursuing this issue in the near future, upgrading to use aws-sdk 2.x is part of our long term roadmap. We have decided to close it for now. It will be reopened when we come back to this issue. The Redshift Driver team appreciates your contribution and thanks you for bringing this to our attention!

[thyming]

What about taking an approach like aws/aws-sdk-java#2434 (comment)

[bhvkshah]

Let me take a look and get back to you. We do plan on starting the migration to v2 sdk soon, so the efforts may be redundant.

[Limess]

We used the approach above in other services/libraries and it was a very low-effort way of resolving the SSO issue which would be easy to swap out when migrating to the V2 SDK.

[thyming]

@bhvkshah any update on this?

[mike-wilson-tubi]

This issue appears to be biting us as well. I have to delete the credentials file using SSO or else my JDBC connections would fail. The error indicates that the JDBC driver is deferring to the credentials file over the config file even if it is empty. I have to delete it altogether for connections to force the driver to use the config file properties.

Any update on this issue?