fix(auth, redshift_auth_profile): read auth profile before validating conn params

Author: Brooke-white

redshift_connector/idp_auth_helper.py

@@ -68,6 +68,32 @@ def set_auth_properties(info: RedshiftProperty):
             _logger.debug("boto3 version: {}".format(Version(pkg_resources.get_distribution("boto3").version)))
             _logger.debug("botocore version: {}".format(Version(pkg_resources.get_distribution("botocore").version)))
 
+            # Check for IAM keys and AuthProfile first
+            if info.auth_profile is not None:
+                if Version(pkg_resources.get_distribution("boto3").version) < Version("1.17.111"):
+                    raise pkg_resources.VersionConflict(
+                        "boto3 >= 1.17.111 required for authentication via Amazon Redshift authentication profile. "
+                        "Please upgrade the installed version of boto3 to use this functionality."
+                    )
+
+                if not all((info.access_key_id, info.secret_access_key, info.region)):
+                    raise InterfaceError(
+                        "Invalid connection property setting. access_key_id, secret_access_key, and region are required "
+                        "for authentication via Redshift auth_profile"
+                    )
+                else:
+                    # info.put("region", info.region)
+                    # info.put("endpoint_url", info.endpoint_url)
+
+                    resp = IdpAuthHelper.read_auth_profile(
+                        auth_profile=typing.cast(str, info.auth_profile),
+                        iam_access_key_id=typing.cast(str, info.access_key_id),
+                        iam_secret_key=typing.cast(str, info.secret_access_key),
+                        iam_session_token=info.session_token,
+                        info=info,
+                    )
+                    info.put_all(resp)
+
             if info.cluster_identifier is None and not info._is_serverless:
                 raise InterfaceError(
                     "Invalid connection property setting. cluster_identifier must be provided when IAM is enabled"
@@ -124,32 +150,6 @@ def set_auth_properties(info: RedshiftProperty):
         if info.db_groups and info.force_lowercase:
             info.put("db_groups", [group.lower() for group in info.db_groups])
 
-        # Check for IAM keys and AuthProfile first
-        if info.auth_profile is not None:
-            if Version(pkg_resources.get_distribution("boto3").version) < Version("1.17.111"):
-                raise pkg_resources.VersionConflict(
-                    "boto3 >= 1.17.111 required for authentication via Amazon Redshift authentication profile. "
-                    "Please upgrade the installed version of boto3 to use this functionality."
-                )
-
-            if not all((info.access_key_id, info.secret_access_key, info.region)):
-                raise InterfaceError(
-                    "Invalid connection property setting. access_key_id, secret_access_key, and region are required "
-                    "for authentication via Redshift auth_profile"
-                )
-            else:
-                # info.put("region", info.region)
-                # info.put("endpoint_url", info.endpoint_url)
-
-                resp = IdpAuthHelper.read_auth_profile(
-                    auth_profile=typing.cast(str, info.auth_profile),
-                    iam_access_key_id=typing.cast(str, info.access_key_id),
-                    iam_secret_key=typing.cast(str, info.secret_access_key),
-                    iam_session_token=info.session_token,
-                    info=info,
-                )
-                info.put_all(resp)
-
     @staticmethod
     def read_auth_profile(
         auth_profile: str,
@@ -185,8 +185,8 @@ def read_auth_profile(
             # 2nd phase - request Amazon Redshift authentication profiles and record contents for retrieving
             # temporary credentials for the Amazon Redshift cluster specified by end user
             response = client.describe_authentication_profiles(AuthenticationProfileName=auth_profile)
-        except ClientError:
-            raise InterfaceError("Unable to retrieve contents of Redshift authentication profile from server")
+        except ClientError as e:
+            raise InterfaceError(e)
 
         _logger.debug("Received {} authentication profiles".format(len(response["AuthenticationProfiles"])))
         # the first matching authentication profile will be used

redshift_connector/redshift_property.py

@@ -136,6 +136,8 @@ def put_all(self, other):
         from copy import deepcopy
 
         for k, v in other.__dict__.items():
+            if k in ("is_serverless_host", "_is_serverless"):
+                continue
             setattr(self, k, deepcopy(v))
 
     def put(self: "RedshiftProperty", key: str, value: typing.Any):

test/unit/test_iam_helper.py

@@ -897,9 +897,7 @@ def test_read_auth_profile_raises_exception_if_profile_dne(mocker):
     )
     mocker.patch("boto3.client", return_value=mock_redshift_client)
 
-    with pytest.raises(
-        InterfaceError, match="Unable to retrieve contents of Redshift authentication profile from server"
-    ):
+    with pytest.raises(InterfaceError):
         IamHelper.read_auth_profile(**req_params)