--- schema_version: "1" id: d02d7772fa5df3aa716e54b8ac10c22f44796781b1db892a7f13e63f16f058cb title: Set Up Amazon Athena IAM OAuth collection: tableau version: current locale: en-gb portal_url: https://docs.salesforce.com/tableau/current/en-gb/pro/desktop/amazon_athena_idp.md canonical_url: https://help.tableau.com/current/pro/desktop/en-gb/amazon_athena_idp.htm source_site: help.tableau.com content_type: documentation content_hash: 36b76adaba10d9d7ab3072bd100d7d1df44c2ad09f7e9e83cdc77797715d4afe description: Set up OAuth 2.0/OIDC identity federation from an external IdP to Amazon Athena for Tableau. --- [Skip to main content](#main-content) # Set Up Amazon Athena IAM OAuth Starting in Tableau 2023.2, you can use OAuth 2.0/OIDC to federate identity from an external identity provider (IDP) to Amazon Athena. Depending on the identity provider, there are different steps needed to configure the integration. Tableau only provides detailed instructions for how to configure Tableau products. For instructions on how to configure your identity provider (such as Okta), refer to that product’s help and tutorials. This document provides a high-level overview of the configuration process. **Note**: Single use refresh tokens (sometimes called rolling refresh tokens or refresh token rotation) are not supported for OAuth connections using Tableau Bridge to Tableau Cloud. Support for these tokens are planned for a future release. **Note:** Steps and links that are outside of Tableau and Salesforce content may not be updated or accurate. ## Configure the Identity Provider (IDP) 1. Create OAuth clients on the IDP for Tableau Desktop and Tableau Server. The Desktop client enables [PKCE](https://auth0.com/docs/get-started/authentication-and-authorization-flow/authorization-code-flow-with-pkce) and uses [http://localhost](http://localhost/) redirects. 2. Add any required custom claims to use for authorisation to roles. For more details about claims and scopes, see [Scopes vs Claims](https://curity.io/resources/learn/scopes-vs-claims/). 3. Create the Tableau OAuth config file. For details on how to do this, see [OAuth Configuration and Usage](https://tableau.github.io/connector-plugin-sdk/docs/oauth) on [github](https://tableau.github.io/connector-plugin-sdk/docs/oauth), as well as examples [here](https://github.com/tableau/en-gb/connector-plugin-sdk/tree/master/samples/components/oauth). Be sure to prefix the Tableau OAuth config IDs with “custom\_”. 4. Install Tableau OAuth config files on Tableau Desktop machines, Tableau Server and Tableau Cloud sites as explained in the OAuth configuration topic linked above. ## Configure IDP on AWS 1. Create the IDP entity. See Amazon docs [Web Identity Federation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_oidc.html), [Create OIDC Identity Provider](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc.html). 2. The IDP must be configured to federate to Athena in a way that works with Tableau's driver plug-in. The following provider information is used for both Tableau Server and Tableau Desktop flows: AwsCredentialsProviderClass=com.simba.athena.iamsupport.plugin.JwtCredentialsProvider role\_session\_name=AthenaJWT 3. Create roles and policies for the IDP specifically. See [Create Role for OIDC](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-idp_oidc.html) on AWS docs. ## Configure Roles for Athena Attach the policies needed for Athena. There are many ways this can be done. One way is using custom claims. You can use custom claims in the openID token to authorise to roles. Those roles are granted access to other resources. For more information see: - Tutorial: [Configuring federated access for Okta users to Athena using Lake Formation and JDBC](https://docs.aws.amazon.com/athena/latest/ug/security-athena-lake-formation-jdbc-okta-tutorial.html). - [Fine-grained access to databases and tables in the AWS Glue Data Catalogue.](https://docs.aws.amazon.com/athena/latest/ug/fine-grained-access-to-glue-resources.html) ## Connect to Athena The user must specify the AWS Role ARN (Amazon Resource Name) to assume and then, under OAuth Provider, select the OAuth config installed earlier. Note that the drop-down menu to select a config will only appear if there are multiple configurations to choose from. When properly configured, the user is redirected to the IDP to authenticate and authorise tokens for Tableau. Tableau receives openID and refresh tokens. AWS is able to validate the token and signature from the IDP, extract the claims from the token, look up the mapping of claims to IAM role and either permit or block Tableau from assuming the role on the user’s behalf. [Example: AssumeRoleWithWebIdentity](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithWebIdentity.html) ![log in to athena window](/tableau/current/en-gb/pro/desktop/en-gb/Img/athenaidp_signin.png) ## Tokens By default, Athena OAuth IAM passes the ID token to the driver. For on-premises customers, including those using Tableau Bridge, you may use a TDC file to pass the access token instead. For more information about configuring and installing .tdc files, see [Customise and Tune a Connection](https://help.tableau.com/current/pro/desktop/en-gb/connect_customize.htm). ## Okta Configuration If using Okta it’s better to use a “custom authorisation server” rather than the “org authorisation server”. The custom authorisation servers are more flexible. There’s a custom authorisation server created by default, which is called “default”. The authorisation URL looks like the following example. `https://${yourOktaDomain}/oauth2/{authServerName}/v1/authorize` ![okta dashboard](/tableau/current/en-gb/pro/desktop/en-gb/Img/athena_okta.png)