Configuring SSO enterprise

This topic describes how to configure Dremio for Single Sign On (SSO) Authentication with an identity provider (IdP) using Azure Active Directory or OpenID.

• Azure Active Directory (Azure AD) Authentication
• OpenID Authentication

Requirements

To use Azure AD or OpenID, Dremio’s webserver must have web server encryption enabled. See the Web Server Encryption section in Configuring Wire Encryption for more information.

Azure Active Directory (Azure AD) Authentication

Setting Up Azure AD

To set up Azure AD:

1. In Azure AD, navigate to the App registrations section and create a new App registration for the Azure AD instance with your name and the account type.

2. Click on New Registration.

3. Complete the Register an application form by adding name, supported account types, and redirect URI of type Web, which is https://<dremio-host>:9047/sso, where <dremio-host> is the hostname or IP address of your Dremio coordinator node.

4. Click Save to save the new registration.

5. Click on the app name that you registered to navigate to the app details screen.

6. Navigate to the Certificates & secrets section, click on New client secret,

7. Provide a client secret description and expiration, click on Add. Be sure to copy the secret and store it safely as it won’t be visible after leaving the page.

8. Navigate to API permissions, click on Add a permission, and then click on Microsoft Graph.

9. Select Application permissions.

10. Under Select permissions, search for User.Read.All and select the checkbox for the User.Read.All result.

11. Search again for Group.Read.All and select the checkbox for the Group.Read.All result.

12. Click Add permissions. Ensure that all of the statuses are green for the listed permissions so that Dremio can read from the Azure AD.

13. Grant Dremio access to your AAD tenant, if access to it was not already granted:

    a. Paste this URL into a web browser, where <tenant-ID> is the tenant ID and <host-url> is the hostname of your Dremio deployment:

    https://login.microsoftonline.com/<tenant-ID>/v2.0/adminconsent?client_id=429333a8-1521-4502-9101-6d4f2c1de644&scope=User.Read&redirect_uri=<host-url>/sso
    

    b. Follow the prompts from Microsoft by signing in with an account that you use to sign into Dremio.

    c. In the prompt titled Need admin approval, click “Have an admin account? Sign in with that account” and sign in with an admin account for your AAD tenant.

Configuring Dremio for Azure AD

When configuring Dremio for Azure AD, you modify the dremio.conf and azuread.json files. These modified files must be copied to the /conf directory on all coordinator nodes.

To configure Dremio for Azure AD:

1. Edit the dremio.conf file to include the following configuration.

   services.coordinator.web.auth.type: "azuread",
   services.coordinator.web.auth.config: "/path/to/azuread.json"
   

2. Create an azuread.json file that includes the following properties:

   {
     "oAuthConfig": {
       "clientId": "<clientId>",
       "clientSecret": "<clientSecret>",
       "redirectUrl": "https://<dremio.host>:9047/sso",
       "authorityUrl": "https://login.microsoftonline.com/<directory.id>/v2.0",
       "scope": "openid profile offline_access",
       "jwtClaims": {
         "userName": "preferred_username"
       }
     }
   }
   

   • clientId: It appears on the Overview screen of your application. This property is also called application ID. A clientId is applicable to the context where you acquire a token using one of the OAuth flows that Azure AD supports. The application ID is same for single application object that corresponds to an application.
   • clientSecret: It is the secret that was created in the Setting Up Azure AD section.
   • redirectUrl: It is the redirect URI that was created in the Setting Up Azure AD section.
   • directory.id: It appears on the Overview screen of your application. This property is also called tenant ID.

3. Copy the modified dremio.conf and azuread.json files to every coordinator node in the Dremio cluster.

Using Azure’s Managed Storage Identities

Dremio supports using Azure’s Managed Storage Identities feature to retrieve the secret when running inside Azure. This feature can be used if you want to avoid storing the secret in plain text.

To setup Azure’s Managed Storage Identities:

1. Create an Azure Keyvault and create a new secret. The Azure Key vault asks for a name and the value (which will be the secret generated for the application).
2. Go to the Access policies section for the Key Vault and add the Azure AD application. Make sure that you give it Get permissions for Secrets.
3. Change the azuread.json value for clientSecret to the following URI:

     ...
     "clientSecret": "azure-vault+https://{keyvault.name}.vault.azure.net/#{secret.name}",
     ...
   

OpenID Authentication

To configure Single Sign On with an Identity Provide over OpenID, perform the following steps:

1. Edit the dremio.conf file to include the following configuration.

   services.coordinator.web.auth.type: "oauth"
   services.coordinator.web.auth.config: "/path/to/oauth.json"
   

2. Create an oauth.json file with the following properties.

   {
     "clientId": "clientId",
     "clientSecret": "clientSecret",
     "redirectUrl": "http://dremioHost:9047/sso",
     "authorityUrl": "authorityUrl",
     "scope": "openid profile email",
     "jwtClaims": {
       "userName": "email"
     },
     "parameters": [
       {"name": "access_type", "value": "offline"},
       ...
     ]
   }
   

The following table describes the oauth.json file properties.

Administration

Logging in with SSO

When SSO is configured, you are redirected to Azure to login using SSO. Dremio also uses Azure AD for directory services and to look up users and groups.

Backing up with SSO

When using a SSO configuration, you must use personal access tokens (PATs) as the SSO password. See Personal Access Tokens for information on enabling PATs.

$ ./dremio-admin backup -u se3@dremioqa.onmicrosoft.com -d /tmp
  password:
  Backup created at /tmp/dremio_backup_2019-07-17_23.08, dremio tables 32, uploaded files 1

If you use your SSO password instead of your PAT as the password, you will see the following:

$ ./dremio-admin backup -u se3@dremioqa.onmicrosoft.com -d /tmp
password:
Failed to create backup at /tmp:java.io.IOException: Status 500 (Internal Server Error):
Something went wrong (more info: Cannot authenticate users when using Azure AD)

Deleting Users

Additional Information

• Authentication
• Personal Access Tokens