> >

Authentication

This section outlines all supported authentication methods for external services with regard to user and group management.

Enterprise Edition only

LDAP, Azure AD, OpenID, and Okta Authentication options are only available in Enterprise Edition

Supported login credential and access control settings for each authentication option are outlined in the following chart.

Authentication Option	Login Credentials - UI	Login Credentials - ODBC/JDBC/REST
Azure AD	Single Sign-On & Personal Access Token	Personal Access Token
LDAP	Username / Password & Personal Access Token	Username / Password & Personal Access Token
Local	Username / Password & Personal Access Token	Username / Password & Personal Access Token
OpenID	Single Sign-On & Personal Access Token	Personal Access Token

Login Credentials

The options available for users to authenticate with Dremio over either browser-based UI or ODBC, JDBC, and Rest sessions are:

Username / Password - User provides a username and password combination for authentication.
Single Sign-On - User is authenticated by the configured Identity Provider, including automatic authentication, if already signed into the Identity Provider.
Personal Access Token - User creates a private access token (PAT) for authentication, which is used in place of a username/password authentication for ODBC, JDBC, and Rest sessions.

NOTE:

When adding user access controls with OpenID authentication, usernames are assumed correct and not validated against a directory service.

User Access Controls

If Yes, the authentication method supports user-level access controls for PDS, VDS, and other objects. When supported access to individual objects can be configured based on the User ID used for authentication.

For organizations using instances of Dremio 15.X and earlier, refer to User and Group Management. If you’re using Dremio 16.0+, refer to the new Users help topic.

Group/Role Access Controls

If Yes, the authentication method supports group/role-level access controls for PDS, VDS, and other objects. When supported, access to individual objects can be configured based upon groups associated with the username used for authentication.

Please note that Okta integration is only available with Dremio 18.0+.

For organizations using instances of Dremio 15.X and earlier, refer to User and Group Management. If you’re using Dremio 16.0+, refer to the new Roles help topic.

AWS Custom Authentication

Version Requirement:

This functionality is only available via Dremio 17.0+.

Glue, S3, and Amazon Elasticsearch sources allow Dremio to use your AWS profile to authenticate users accessing your AWS-hosted data.

This authentication is performed by selecting the AWS Profile option for a source. Dremio will use credentials from the selected profile in the credentials file to authenticate with the source. Multiple methods are available for authentication, such as an external process. However, such processes must be created and validated for security by the user themselves.

Note:

We recommend using supported and secure methods via the AWS SDK and AWS application to minimize the potential for security risks.

For users with methods of generating and/or looking up credentials that may not be supported by the AWS SDK, you may alter the SDK to use your tool still by using additional configurations, such as the credential_process setting in the credentials file. Again, additional options are available for authenticating users via AWS. For more details regarding the storage of configuration settings and credentials maintained by AWS SDK, read AWS’s Configuration and credential file settings documentation. This discusses both the supported settings available for inclusion on the configuration and credential files, as well as details regarding the storage of credentials.

Further information regarding this setting is found at AWS’s documentation for Sourcing credentials with an external process. This help topic outlines not only how to execute your command, but also how to structure the expected JSON-formatted output from a Credentials program, which Dremio requires.

For More Information

To configure LDAP refer to Setting Up LDAP

To configure Azure AD or OpenID with Single Sign On refer to Configuring Single Sign On