Data Platform (Bring Your Own BI/Data Share) - OAuth Client Credentials Service Users
In order to use OAuth client credentials flow authorisation to access your data, you must first create a service user which will provide you with an OAuth client ID, secret and other details required by either Snowflake ODBC client or the Snowflake RESTful API.
You can conveniently set up and manage your own OAuth Client Credentials Service Users directly in apps.oneadvanced.com. You will need to be a Customer admin to use this functionality.
Prerequisites
To create or manage service users, you need the following licences assigned to your organisation via Licence Admin. If you don't have these licences, please ask your account manager or services contact to assign them to your organisation.
- "Data Platform Admin Module" — assign to admin users only (users that you want to be able to create/manage service users)
- "Data Platform - Data Share - Shared" — does not need to be assigned to any specific users, but the provisioner for this licence needs to be run
- "Data Platform - [dataset name] - BYOBI" — assign to named users only; do not use "assign to all users" — this triggers user creation on the data platform side and needs to be specific.
The users you assigned the "Data Platform Admin Module" licence to will now be able to see the "Data Platform Admin" pane in https://apps.oneadvanced.com/
Viewing service users
On the Service Users page, you will see a list of all your existing clients. From this list, you can manage your Service Users through several actions such as edit, delete and rotate the secret. You can also add new OAuth Client Credentials Service Users from here.
Creating a new service user
- Open the Service Users page and click on Add service user button at the top right.
- Provide a username (any set of characters is acceptable) then click the Dataset Grants dropdown to select the product dataset(s) you require this user to have access to - at least 1 dataset must be selected.
- Click Add service user to create the client.
- After the user is created, the credentials you require will be displayed - make sure to manage the secrets appropriately.
Managing secrets
For security reasons, secrets are hidden by default. You can view the secret by clicking on the eye icon. You can copy secrets to your clipboard using the Copy button to make it easy to input.
In cases of loss, theft, or to ensure good security practices, the secret can be rotated. This involves generating a new random string as a secret.
To rotate a secret, go to the Service Users screen, click on the actions icon and select Rotate secret.
You will need to input the service user's name to confirm the operation, which can't be undone. Once the rotation is successful, the old secret will immediately no longer be usable.
Making changes to an existing service user
You can only make changes to the selected dataset grants for an existing service user. From the service users screen, click on the actions icon and select Edit.
Deleting a service user
You can delete a client from the service users screen by clicking more options and selecting Delete. Service user removal is immediate and cannot be undone.
FAQs
Q: I have received this error, what should I do:
A: Contact your OneAdvanced technical or support representative.
