Linux DSN Configuration
This section describes how to set up ODBC connectivity and configure DSNs on several Linux distributions: Debian-based systems, like Ubuntu, and Red Hat Linux platforms, like Red Hat Enterprise Linux (RHEL) and Fedora.
Minimum Linux Versions
Here are the minimum supported versions for Red Hat-based and Debian-based systems:
OS | Min. Version |
Ubuntu | 18.04 |
Debian | 10 |
RHEL | 8 |
Fedora | 28 |
SUSE | 15 |
Installing the Driver Dependencies
Run the following commands as root or with sudo to install the necessary dependencies:
- Debian/Ubuntu:
apt-get install libc6 libstdc++6 zlib1g libgcc1
- RHEL/Fedora:
yum install glibc libstdc++ zlib libgcc
Installing the Driver
You can use standard package management systems to install the driver.
On Debian-based systems, like Ubuntu, run the following command with root or sudo:
dpkg -i /path/to/driver/setup/AmazonAthenaODBCDriverforUnix.deb
On systems that support the RPM package format, run the following command with root or sudo:
rpm -ivh /path/to/driver/AmazonAthenaODBCDriverforUnix.rpm
Licensing the Driver
Run the following commands to license the driver. To activate a trial, omit the <key> input.
cd /opt/cdata/cdata-odbc-driver-for-amazonathena/bin/
sudo ./install-license.sh <key>
Connecting through the Driver Manager
The driver manager loads the driver and passes function calls from the application to the driver. You need to register the driver with the driver manager and you define DSNs in the driver manager's configuration files.
The driver installation registers the driver with the unixODBC driver manager and creates a system DSN. The unixODBC driver manager can be used from Python and from many other applications. Your application may embed another driver manager.
Creating the DSN
See Using unixODBC to install unixODBC and configure DSNs. See Using the DataDirect Driver Manager to create a DSN to connect to OBIEE, Informatica, and SAS.
Connecting to Amazon Athena
Specify the following to connect to data:- DataSource: The name of the Amazon Athena data source to connect to.
- Database: The name of the Amazon Athena database to connect to.
- AWSRegion: Set this to the region where your Amazon Athena data is hosted.
- S3StagingDirectory: Set this to a folder in S3 where you would like to store the results of queries.
If Database and DataSource are not specified, the driver tries to list all databases from the available data sources in Amazon Athena. Setting both properties improves the performance of the driver.
Authenticating to Amazon Athena
In addition to specifying basic connection information required for all connections, you must choose an authentication method from one of the following options.Obtain AWS Keys
To obtain the credentials for an IAM user:- Sign into the IAM console.
- In the navigation pane, select Users.
- To create or manage the access keys for a user, select the user and then go to the Security Credentials tab.
- Sign into the AWS Management console with the credentials for your root account.
- Select your account name or number.
- In the menu that displays, select My Security Credentials.
- To manage or create root account access keys, click Continue to Security Credentials and expand the "Access Keys" section.
Root Credentials
To authenticate using account root credentials, set these configuration parameters:
- AuthScheme: AwsRootKeys.
- AWSAccessKey: The access key associated with the AWS root account.
- AWSSecretKey: The secret key associated with the AWS root account.
Note: Use of this authentication scheme is discouraged by Amazon for anything but simple tests. The account root credentials have the full permissions of the user, making this the least secure authentication method.
If multi-factor authentication is required, specify the following:
- CredentialsLocation: The location of the settings file where MFA credentials are saved. See the Credentials File Location page under Connection String Options for more information.
- MFASerialNumber: The serial number of the MFA device if one is being used.
- MFAToken: The temporary token available from your MFA device.
Note: If you want to control the duration of the temporary credentials, set the TemporaryTokenDuration property (default: 3600 seconds).
Temporary Credentials
To authenticate using temporary credentials, specify the following:
- AuthScheme: TemporaryCredentials.
- AWSAccessKey: The access key of the IAM user to assume the role for.
- AWSSecretKey: The secret key of the IAM user to assume the role for.
- AWSSessionToken: Your AWS session token, provided with your temporary credentials. For details, see AWS Identity and Access Management User Guide.
The driver can now request resources using the same permissions provided by long-term credentials (such as IAM user credentials) for the lifespan of the temporary credentials.
To authenticate using both temporary credentials and an IAM role, set all the parameters described above, and specify these additional parameters:
- AWSRoleARN: Specify the Role ARN for the role you'd like to authenticate with. This prompts the driver to retrieve credentials for the specified role.
- AWSExternalId (optional): Only required if you are assuming a role in another AWS account.
If multi-factor authentication is required, specify the following:
- CredentialsLocation: The location of the settings file where MFA credentials are saved. See the Credentials File Location page under Connection String Options for more information.
- MFASerialNumber: The serial number of the MFA device if one is being used.
- MFAToken: The temporary token available from your MFA device.
Note: If you want to control the duration of the temporary credentials, set the TemporaryTokenDuration property (default: 3600 seconds).
EC2 Instances
Set AuthScheme to AwsEC2Roles.
If you are using the driver from an EC2 Instance and have an IAM Role assigned to the instance, you can use the IAM Role to authenticate. Since the driver automatically obtains your IAM Role credentials and authenticates with them, it is not necessary to specify AWSAccessKey and AWSSecretKey.
If you are also using an IAM role to authenticate, you must additionally specify the following:
- AWSRoleARN: Specify the Role ARN for the role you'd like to authenticate with. This will cause the driver to attempt to retrieve credentials for the specified role.
- AWSExternalId (optional): Only required if you are assuming a role in another AWS account.
IMDSv2 Support
The Amazon Athena driver now supports IMDSv2. Unlike IMDSv1, the new version requires an authentication token. Endpoints and response are the same in both versions.
In IMDSv2, the Amazon Athena driver first attempts to retrieve the IMDSv2 metadata token and then uses it to call AWS metadata endpoints. If it is unable to retrieve the token, the driver reverts to IMDSv1.
AWS Web Identity
Set AuthScheme to AwsWebIdentity.
If you are using the driver from a container configured to assume role with web identity (such as a Pod in an EKS cluster with an OpenID Provider) or have obtained an identity token by authenticating with a web identity provider associated with an IAM role, you can exchange the web identity token and IAM role information for temporary security credentials to authenticate and access AWS services. The driver automatically obtains the credentials if the container has AWS_ROLE_ARN and AWS_WEB_IDENTITY_TOKEN_FILE specified in the environment variables. Alternatively, you can specify both AWSRoleARN and AWSWebIdentityToken to execute the AssumeRoleWithWebIdentity API operation and authenticate.
AWS IAM Roles
Set AuthScheme to AwsIAMRoles.
In many situations, it may be preferable to use an IAM role for authentication instead of the direct security credentials of an AWS root user. If you are specifying the AWSAccessKey and AWSSecretKey of an AWS root user, you may not use roles.
To authenticate as an AWS role, set these properties:
- AWSAccessKey: The access key of the IAM user to assume the role for.
- AWSSecretKey: The secret key of the IAM user to assume the role for.
- AWSRoleARN: Specify the Role ARN for the role you'd like to authenticate with. This will cause the driver to attempt to retrieve credentials for the specified role.
- AWSExternalId (optional): Only required if you are assuming a role in another AWS account.
If multi-factor authentication is required, specify the following:
- CredentialsLocation: The location of the settings file where MFA credentials are saved. See the Credentials File Location page under Connection String Options for more information.
- MFASerialNumber: The serial number of the MFA device if one is being used.
- MFAToken: The temporary token available from your MFA device.
Note: If you want to control the duration of the temporary credentials, set the TemporaryTokenDuration property (default: 3600 seconds).
ADFS
To connect to ADFS, set the AuthScheme to ADFS, and set these properties:
- User: The ADFS user.
- Password: The ADFS user's password.
- SSOLoginURL: The SSO provider's login url.
Example connection string:
AuthScheme=ADFS; AWSRegion=Ireland; Database=sampledb; [email protected]; Password=CH8WerW121235647iCa6; SSOLoginURL='https://adfs.domain.com'; AWSRoleArn=arn:aws:iam::1234:role/ADFS_SSO; AWSPrincipalArn=arn:aws:iam::1234:saml-provider/ADFSProvider; S3StagingDirectory=s3://athena/staging;
ADFS Integrated
The ADFS Integrated flow indicates you are connecting with the currently logged in Windows user credentials. To use the ADFS Integrated flow, do not specify the User and Password, but otherwise follow the same steps in the ADFS guide above.
Okta
To connect to Okta, set the AuthScheme to Okta, and set these properties:
- User: The Okta user.
- Password: The Okta user's password.
- SSOLoginURL: The SSO provider's login URL.
If you are using a trusted application or proxy that overrides the Okta client request OR configuring MFA, you must use combinations of SSOProperties to authenticate using Okta. Set any of the following, as applicable:
- APIToken: When authenticating a user via a trusted application or proxy that overrides the Okta client request context, set this to the API Token the customer created from the Okta organization.
- MFAType: If you have configured the MFA flow, set this to one of the following supported types: OktaVerify, Email, or SMS.
- MFAPassCode: If you have configured the MFA flow, set this to a valid passcode.
If you set this to empty or an invalid value, the driver issues a one-time password challenge to your device or email. After the passcode is received, reopen the connection where the retrieved one-time password value is set to the MFAPassCode connection property. - MFARememberDevice: True by default. Okta supports remembering devices when MFA is required. If remembering devices is allowed according to the configured authentication policies, the driver sends a device token to extend MFA authentication lifetime. If you do not want MFA to be remembered, set this variable to False.
Example connection string:
AuthScheme=Okta; AWSRegion=Ireland; Database=sampledb; [email protected]; Password=CH8WerW121235647iCa6; SSOLoginURL='https://cdata-us.okta.com/home/amazon_aws/0oa35m8arsAL5f5NrE6NdA356/272'; SSOProperties='ApiToken=01230GGG2ceAnm_tPAf4MhiMELXZ0L0N1pAYrO1VR-hGQSf;'; AWSRoleArn=arn:aws:iam::1234:role/Okta_SSO; AWSPrincipalARN=arn:aws:iam::1234:saml-provider/OktaProvider; S3StagingDirectory=s3://athena/staging;
To connect to PingFederate, set AuthScheme to PingFederate, and set these properties:
- User: The PingFederate user.
- Password: The PingFederate user's password.
- SSOLoginURL: The SSO provider's login url.
- AWSRoleARN (optional): If you have multiple role ARNs, specify the one you want to use for authorization.
- AWSPrincipalARN (optional): If you have multiple principal ARNs, specify the one you want to use for authorization.
- SSOExchangeUrl: The Partner Service Identifier URI configured in your PingFederate server instance under: SP Connections > SP Connection > WS-Trust > Protocol Settings. This should uniquely identify a PingFederate SP Connection, so it is a good idea to set it to your AWS SSO ACS URL. You can find it under AWS SSO > Settings > View Details next to the Authentication field.
- SSOProperties (optional): Authscheme=Basic if you want to include your username and password as an authorization header in requests to Amazon S3.
To enable mutual SSL authentication for SSOLoginURL, the WS-Trust STS endpoint, configure these SSOProperties:
- SSLClientCert
- SSLClientCertType
- SSLClientCertSubject
- SSLClientCertPassword
Example connection string:
authScheme=pingfederate;SSOLoginURL=https://mycustomserver.com:9033/idp/sts.wst;SSOExchangeUrl=https://us-east-1.signin.aws.amazon.com/platform/saml/acs/764ef411-xxxxxx;user=admin;password=PassValue;AWSPrincipalARN=arn:aws:iam::215338515180:saml-provider/pingFederate;AWSRoleArn=arn:aws:iam::215338515180:role/SSOTest2;AWSRegion=Ireland;S3StagingDirectory=s3://somedirectory/staging;Database=athenadatabase;
Credentials Files
You can use a credentials file to authenticate. Any configurations related to AccessKey/SecretKey authentication, temporary credentials, role authentication, or MFA can be used. To do so, set the following properties to authenticate:
- AuthScheme: AwsCredentialsFile.
- AWSCredentialsFile: The location of your credentials file.
- AWSCredentialsFileProfile (optional): The name of the profile you would like to use from the specified credentials file. If not specified, the default profile is used.
AWS Cognito Credentials
If you want to use the driver with a user registered in a User Pool in AWS Cognito, set the following properties to authenticate:
- AuthScheme: Set this to AwsCognitoSrp (recommended). You can also use AwsCognitoBasic.
- AWSCognitoRegion: Set this to the region of the User Pool.
- AWSUserPoolId: Set this to the User Pool Id.
- AWSUserPoolClientAppId: Set this to the User Pool Client App Id.
- AWSUserPoolClientAppSecret: Set this to the User Pool Client Secret.
- AWSIdentityPoolId: Set this to the Identity Pool Id of the Identity Pool that is linked with the User Pool.
- User: Set this to the username of the user registered in the User Pool.
- Password: Set this to the password of the user registered in the User Pool.
Azure Active Directory/Microsoft Entra ID
NOTE: Azure AD is now Microsoft Entra ID.This configuration uses 2.0 On-Behalf-Of flow (Microsoft identity platform and OAuth 2.0 On-Behalf-Of flow ), which requires two Microsoft Entra applications:
- the "Amazon Athena" application used for single sign-on
- a separate "connector" application with user_impersonation permission on the "Amazon Athena" application
You must follow the steps outlined in Microsoft's AWS Single-Account Access documentation to create the SSO application and set Microsoft Entra ID as the SAML IdP for an AWS single-account app.
To create an application with user_impersonation permission on the SSO application, follow these steps:
- Sign into the Microsoft Entra admin center as at least a Cloud Application Administrator.
- Navigate to Identity > Applications > App registrations.
- Click New application at the top of the page.
- Enter a name and select supported account types as desired.
- Select Web in the Redirect URI dropdown, and enter http://localhost:33333.
- Select Register.
- In the "Overview" section, you can see your OAuthClientId (Application ID).
- Select API permissions > Add a permission.
- Select the API of your SSO application by specifying its name or Application Id in the "APIs my organization uses" tab.
- Select user_impersonation from the available list of Permissions.
- Select Add permissions.
- Select Certificates & secrets.
- Select New client secret.
- Optionally, enter a description and change the default Expires value, then select Add.
- Save your client secret (the Value field of the OAuth secret that is displayed).
- OAuthClientId: The application Id of the connector application, listed in the Overview section of the application registration.
- OAuthClientSecret : The client secret value of the connector application. Azure AD displays this when you create a new client secret.
- CallbackURL: Set this to the redirect URI of the connector application. For example: https://localhost:33333.
- InitiateOAuth: GETANDREFRESH.
Use the following SSOProperties to authenticate to AzureAD:
- Resource: The application Id URI of the Amazon Athena application, listed in the Overview section of the application registration. In most cases this is the URL of your custom Amazon Athena domain.
- AzureTenant: The Id of the Azure AD tenant where the applications are registered.
The following is an example connection string:
AuthScheme=AzureAD;InitiateOAuth=GETANDREFRESH;OAuthClientId=3ea1c786-d527-4399-8c3b-2e3696ae4b48;OauthClientSecret=xxx;CallbackUrl=https://localhost:33333;SSOProperties='Resource=https://signin.aws.amazon.com/saml;AzureTenant=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx';
Set the Driver Encoding
The ODBC drivers need to specify which encoding to use with the ODBC Driver Manager. By default, the CData ODBC Drivers for Unix are configured to use UTF-16 which is compatible with unixODBC, but other Driver Managers may require alternative encoding.
Alternatively, if you are using the ODBC driver from an application that uses the ANSI ODBC API it may be necessary to set the ANSI code page. For example, to import Japanese characters in an ANSI application, you can specify the code page in the config file '/opt/cdata/cdata-odbc-driver-for-amazonathena/lib/cdata.odbc.amazonathena.ini':
[Driver]
AnsiCodePage = 932