AWS IAM support for logging in

[Fyb3roptik]

Please add support for logging in via AWS IAM

[rudemateo]

https://aws.amazon.com/about-aws/whats-new/2018/09/amazon-rds-postgresql-now-supports-iam-authentication/

[jakob]

I've seen a few requests for this recently (also with regard to Redshift) and I'm wondering how to best implement this. It's probably a lot of UI work, so I want to think about how to best integrate this into Postico.

Do you have any suggestions how you imagine the UI should look like? Are there any other DB clients that have AWS IAM integration?

As a quick solution, it should be possible to write a shell script that fetches temporary credentials using aws-cli, and then use the 'open' command to connect to the db with Postico:

#!/bin/bash
PASS=$(some command that fetches a password)
open -a Postico postgres://user:"$PASS"@dbhost:5432/dbname

[Fyb3roptik]

AWS AMI should just use username/password. It is just generated by AWS for you.

[brandon-dacrib]

AWS AMI should just use username/password. It is just generated by AWS for you.

I don't think you are understanding the problem. Some folks use a more advanced method than simple username/password to authenticate to redshift. There is an option to request essentially a one time token using your IAM credentials which is then used to authenticate to the database. Here is some documentation. https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-iam-access-control-identity-based.html

[jakob]

I'm still not quite sure how to implement IAM authentication. I've read the docs, and it seems pretty straightforward. I guess I'll have to do an API call to get a (temporary) password, and then use that to connect to the PostgreSQL / Redshift server.

But how should it work? How would you imagine the UI to look like? Are there any other apps that offer IAM authentication?

[jakob]

OK, so I played around, and I built a little demo app that takes an AWS Redshift IAM URL, and fetches the DB credentials, and then opens the URL with Postico.

It looks like this:

There's a bug in Postico 1.4.3 where passwords with special characters from URLs are incorrectly parsed. Since random IAM passwords often contain special characters, this might cause connections to fail. So use the demo app with this build of Postico: Postico 3937.zip

I'm not sure how to integrate this into Postico. Can you try the demo app? Is it useful? What would you like improved?

[jakob]

Looks like I forgot to upload the demo app. It's hard to try a screenshot :)

Here's the link: AWS Playground.zip

[jakob]

For future reference: Redshift IAM URLs are documented here:
https://docs.aws.amazon.com/redshift/latest/mgmt/generating-iam-credentials-configure-jdbc-odbc.html

Note: The "AWS Playground" tool above currently only supports URLS of the form jdbc:redshift:iam://identifier.xyz.region.redshift.amazonaws.com. URLs of the form jdbc:redshift:iam://name:region are not yet supported (require an extra API call)

[ian-axelrod]

@jakob Any updates on this? Definitely would be useful.

By the way, I'm happy to offer suggestions on how this could look, UI wise.

[yepher]

I have a script that I generate my temporary password (password expires after some time). I have a saved favorite connection (where I have unchecked Save In Keychain but seems to still save the password :( )

When that password times out Postico is basically stuck and I have to close the window and go back to the connection favorites, click edit, and enter a new password. Why doesn't Postico just prompt for the new username/password which is very common amongst other similar apps?

Is there a way to enter the updated password without backing all the way out and starting over?

One good immediate enhancement would be to prompt the user for the new password when authentication fails while Postico is re-establishing the connection.

This is what my connection favorite looks like:

[kblflivingston]

Don't suppose there is an update on this is there? Our support team needs to connect to our redshift db's using iam to query around and right now they are all using sql workbench J. If I can upgrade them to postico they will be happy campers, but we can't do that until iam is supported.

[jgn]

This would be a very welcome feature in our environment . . .

[Fyb3roptik]

Ok I moved to Aurora Serverless and am now in need of this!

[Shikkic]

Would love this +1

[ian-axelrod]

Plz to add support. I am crying.