Is the current version working well with Redshift serverless with OKTA (BrowserSamlCredentialsProvider)?

[radoslawkosinski]

We are trying to use redshift_connector(Redshift Python Driver 2.0.910 and latest boto3) with redshift serverless and OKTA.
Previously we had no issues with redshift provisioned but on serverless for some reeason, the session is established with the IAM role ('IAMR:') instead of the logged in user('select current_user;'). Are there any restrictions or special considerations with current version and servberless + OKTA?

[Brooke-white]

Hi @radoslawkosinski, is the Okta SAML assertion configured with a "Preferred Role"? If so, this role is likely provided in the SAML response redshift-connector receives from Okta, and uses for authentication with boto3. Additionally you can check if the database user is provided in the SAML assertion.

[radoslawkosinski]

Thanks @Brooke-white , I don't provide preferred role(but I tried with that too). The same with db_user - if not passed then db_user is taken from saml response.
So here is how I call the connect method:

    connection = redshift_connector.connect(
        iam=True,
        database='database',
        region="region",
        host='***',
        cluster_identifier='****',
        credentials_provider='BrowserSamlCredentialsProvider',
        login_url='*****',
        db_user='****', --works without this value too (saml call returns correct user)
        iam_disable_cache=True, #I tried with and without this

This works fine with provisioned Redshift cluster. Also it works well with serverless with username and password.
I was debugging SAML response and it looks the same as I received when calling provisioned one(which works well).
The get assume role returns also the same response(obviously except the AccessKeyId, SecretAccessKey and SessionToken) as when I called provisioned cluster - this means there is the user ID, sts credentials, AssumedRoleId, Arn etc, all in the same format as I received when called provisioned cluster - so I think no problems at this point.
When I checked credentials array, I see db_user along with other things, the user_name is empty (same when I called provisioned cluster).
Then, later on, it calls boto3 GetCredentials API(serverless).
Then, the cred contains dbPassword and IAM role as dbUser, similarily on info.user_name populated with actual role(IAMR:***) which is obviously incorrect.

                    cred = typing.cast(
                        typing.Dict[str, typing.Union[str, datetime.datetime]],
                        client.**get_credentials**(**get_cred_args),
                    )

the get_credentials is called with dbName and workgouprName only(**get_cred_args) btw.
So for some reason, for the given dbPassword, dbUser the IAM role is returned instead of the database user.