--- schema_version: "1" id: 0de801fd9031f4d33a746e668f3eb2852f252f583b6b251658783a431d109e39 title: Set Up Amazon Athena IAM OAuth collection: tableau version: next locale: en-us portal_url: https://docs.salesforce.com/tableau/next/en-us/pro/desktop/amazon_athena_idp.md canonical_url: https://help.tableau.com/v0.0/pro/desktop/en-us/amazon_athena_idp.htm source_site: help.tableau.com content_type: documentation content_hash: 36b1ae6dee9c5090cb501a36e1a8ded2a506d12f850ac45920dbb468f5d209e0 description: Set up OAuth 2.0/OIDC identity federation from an external IdP to Amazon Athena for Tableau. --- [Skip to main content](#main-content) # Set Up Amazon Athena IAM OAuth Starting in Tableau 2023.2, you can use OAuth 2.0/OIDC to federate identity from an external identity provider (IDP) to Amazon Athena. Depending on the identity provider, there are different steps needed to configure the integration. Tableau only provides detailed instructions for how to configure Tableau products. For instructions on how to configure your identity provider (such as Okta), refer to that product's help and tutorials. This document provides a high-level overview of the configuration process. **Note**: Single use refresh tokens (sometimes called rolling refresh tokens or refresh token rotation) are not supported for OAuth connections using Tableau Bridge to Tableau Cloud. Support for these tokens are planned for a future release. **Note:**Steps and links that are outside of Tableau and Salesforce content, may not be updated or accurate. ## Configure the Identity Provider (IDP) 1. Create OAuth clients on the IDP for Tableau Desktop and Tableau Server. The Desktop client enables [PKCE](https://auth0.com/docs/get-started/authentication-and-authorization-flow/authorization-code-flow-with-pkce) and uses [http://localhost](http://localhost/) redirects. 2. Add any required custom claims to use for authorization to roles. For more details about claims and scopes, see [Scopes vs Claims](https://curity.io/resources/learn/scopes-vs-claims/). 3. Create the Tableau OAuth config file. For details on how to do this, see [OAuth Configuration and Usage](https://tableau.github.io/connector-plugin-sdk/docs/oauth) on [github](https://tableau.github.io/connector-plugin-sdk/docs/oauth), and examples [here](https://github.com/tableau/connector-plugin-sdk/tree/master/samples/components/oauth). Be sure to prefix the Tableau OAuth config IDs with "custom\_". 4. Install Tableau OAuth config files on Tableau Desktop machines, Tableau Server, and Tableau Cloud sites as explained in the OAuth configuration topic linked above. ## Configure IDP on AWS 1. Create the IDP entity. See Amazon docs [Web Identity Federation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_oidc.html), [Create OIDC Identity Provider](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc.html). 2. The IDP must be configured to federate to Athena in a way that works with Tableau's driver plug-in. The following provider information is used for both Tableau Server and Tableau Desktop flows: AwsCredentialsProviderClass=com.simba.athena.iamsupport.plugin.JwtCredentialsProvider role\_session\_name=AthenaJWT 3. Create roles and policies for the IDP specifically. See [Create Role for OIDC](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-idp_oidc.html) on AWS docs. ## Configure Roles for Athena Attach the policies needed for Athena. There are many ways this can be done. One way is using custom claims. You can use custom claims in the openID token to authorize to roles. Those roles are granted access to other resources. For more information see: - Tutorial: [Configuring federated access for Okta users to Athena using Lake Formation and JDBC](https://docs.aws.amazon.com/athena/latest/ug/security-athena-lake-formation-jdbc-okta-tutorial.html). - [Fine-grained access to databases and tables in the AWS Glue Data Catalog.](https://docs.aws.amazon.com/athena/latest/ug/fine-grained-access-to-glue-resources.html) ## Connect to Athena The user must specify the AWS Role ARN (Amazon Resource Name) to assume, and then, under OAuth Provider, select the OAuth config installed earlier. Note the drop-down menu to select a config will only appear if there are multiple configurations to choose from. When properly configured, the user is redirected to the IDP to authenticate and authorize tokens for Tableau. Tableau receives openid and refresh tokens. AWS is able to validate the token and signature from the IDP, extract the claims from the token, look up the mapping of claims to IAM role, and either permit or block Tableau from assuming the role on the user's behalf. [Example: AssumeRoleWithWebIdentity](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithWebIdentity.html) ![log into athena window](/tableau/next/en-us/pro/desktop/en-us/Img/athenaidp_signin.png) ## Tokens By default, Athena OAuth IAM passes the ID token to the driver. For on-premises customers, including those using Tableau Bridge, you may use a TDC file to pass the access token instead. For more information about configuring and installing .tdc files, see [Customize and Tune a Connection](https://help.tableau.com/current/pro/desktop/en-us/connect_customize.htm). ## Okta Configuration If using Okta it's better to use a "custom authorization server" rather than the "org authorization server." The custom authorization servers are more flexible. There's a custom authorization server created by default, which is called "default". The authorization URL looks like the following example. `https://${yourOktaDomain}/oauth2/{authServerName}/v1/authorize` ![okta dashboard](/tableau/next/en-us/pro/desktop/en-us/Img/athena_okta.png)