Authenticating dbt Core to Amazon Redshift using Keycloak

In-Depth Discussions
,
1

Hi everyone,

We want to use Keycloak as the only identity source for users running dbt Core against Amazon Redshift.

Each user should:

  • Authenticate through Keycloak.
  • Connect to Redshift from dbt using temporary credentials.
  • Be represented by their individual identity for auditing.
  • Receive Redshift roles based on their Keycloak groups.
  • Avoid permanent database passwords.

The expected flow would be approximately:

User → Keycloak → dbt Core → Amazon Redshift

We are currently investigating the following questions:

  1. Does dbt-redshift support authentication through a generic SAML or OIDC provider such as Keycloak?
  2. Can the Redshift Python driver’s BrowserSamlCredentialsProvider or another custom credentials provider be configured through profiles.yml?
  3. Can Keycloak attributes or groups be mapped to the Redshift database user and roles?
  4. If direct integration is not supported, what is the recommended way to obtain temporary credentials from Keycloak before running dbt?
  5. Has anyone implemented a similar Keycloak → dbt Core → Redshift authentication flow without developing a custom adapter?

Environment

  • dbt Core: 1.10.9
  • dbt-redshift: 1.9.5
  • Amazon Redshift: Serverless
  • Identity Provider: Keycloak

Any recommended architecture or configuration example would be greatly appreciated.