SAS/ACCESS Interface to Teradata now supports Single Sign-On (SSO) authentication using one of two methods:

• Connect using refresh tokens.
• Authenticate using a client ID and client secret.    

Connect Using Refresh Tokens

With the first method, you authenticate to an external identity provider (IdP) as a user with permission to obtain refresh tokens.  The tokens are JSON web tokens (JWTs). These IdP are updated transparently to the user and are used to connect to Teradata. To connect to Teradata using refresh tokens, use the following options:

• OAUTH_REFRESH_TOKEN=
• OAUTH_TOKEN_ENDPOINT=
• (Optional) OAUTH_SCOPE=

Authenticate Using a Client ID and Client Secret

With the second method, you can use the client ID and client secret to request a JWT from an IdP. The JWT is used to authenticate to Teradata. This method is used to run a batch script that connects with a Client Grant type connection. This method requires the following four options:

• OAUTH_CLIENT_ID=
• OAUTH_CLIENT_SECRET=
• OAUTH_SCOPE=
• OAUTH_TOKEN_ENDPOINT=

Note: The options are valid in the LIBNAME statement, CONNECT TO statement, or with the FEDSQL procedure.