ODBC Custom Connector- SAML profile

[SaiK]

Hello,
I want to create acustom ODBC connector that will use the SAML aws profile. 
The background is: I have temporary credentials which rotate hourly. In the odbc connector I am using athena driver and authentication type as IAM Profile. I am able to use this 'saml' IAM Profile inside power bi desktop successfully with the athena connector(I just write the dsn name and it works automatically). But this doesn't work in Power BI service because the gateway doesn't recognize the 'saml' profile. 
So I want to build a custom connector that would help me accomplish this. Basically in both, desktop and service when I click on SAML in the authentication options(I want the custom connector to display that option) it should automatically get authenticated in the backend. 
Please help out!

[v-sdhruv · Accepted solution]

Hi @SaiK ,

I get the hesitation with custom connectors. But unfortunately power BI Service does not natively support IAM profiles or roles (like EC2/ECS/EKS instance roles) when using certified connectors such as Amazon Athena.
It requires AWS access key and secret key authentication — even with the built-in Athena connector.
Power BI Service does not run in AWS environment, so it cannot assume an IAM role from metadata.

In Power BI Desktop, the Athena ODBC driver reads your ~/.aws/credentials file and environment variables. It can automatically use the saml profile because it's running locally and can execute your credential_process or run AWS CLI/SSO flows.
Hope this helps!

 If this answers your question, please Accept it as a solution and give it a 'Kudos' so others can find it easily.
Thank you.

[SaiK]

Is there any other way to automate the process?
Now that I will be using the credentials, could you suggest a methodology to automate the process of renewing the credentials automatically in power bi service?

[lbendlin]

process automation and responsible credential policies (especially MFA) are fundamentally incompatible.

[SaiK]

So, the best case scenario would be updating the credentials manually as and when required?

[SaiK]

Okay Shruti! Thanks a lot for clearing the air!

[tharunkumarRTK]

@SaiK 

I think to look deeper into the connectivity and how authentication is working from the Power BI desktop to the athena source and validate the M code before building the connector. You can follow this learning path to know more about how you can create custom connector and you will also find some sample M code here 

https://learn.microsoft.com/en-us/power-query/creating-first-connector

Need a Power BI Consultation? Hire me on Upwork

Connect on LinkedIn

Did I answer your question? Mark my post as a solution!
If I helped you, click on the Thumbs Up to give Kudos. Proud to be a Super User!

[SaiK]

Is it possible to use IAM profile in connectors in power bi service? I tried using it with the athena connector but it is having some issues. I don't want to go the custom connector way if there is a possiblity of using iam profiles direclty with certified connectors.