A dynamic authorization code grant allows you to initiate an authorization code grant flow by specifying login credentials using the login prompt for your service, thereby providing a method to authenticate without fetching access and refresh tokens via the Configuration Manager or third-party application. Similar to authorization code grant, dynamic authorization code grant is typically used for web and native applications. It also provides secure connections by requiring multiple points of authentication before permitting access to data.

When connecting with dynamic authorization code grant flow, the driver launches the login prompt for your service in a separate browser window. After you submit your user and password credentials via the prompt, the driver exchanges your login credentials and client credentials for the Authorization Code from the location specified by the Authorization URI option. The driver then navigates to the endpoint specified by the Token URI option to exchange the authorization code for the access and refresh tokens. Finally, the application is redirected to the location provided in the Redirect URI option to begin the session.

After the grant flow is complete, the driver continues to use the access and refresh tokens to access data resources for the lifetime of the ODBC connection or until both the access and refresh tokens expire, whichever occurs first. If both tokens expire while the connection is still active, the driver launches the login prompt to reinitiate the flow.

Note: The dynamic authorization grant requires the manual submission of login credentials via the login prompt for your service; therefore, the driver does not support dynamic authorization grant in headless environments.
To use dynamic authorization code grant:
  • Set the Authentication Method (AuthenticationMethod) option to oauth2.0.
  • Set the Enable Login Prompt (EnableLoginPrompt) option to 1 (enabled). When Enable Login Prompt is enabled, the driver launches the login prompt for your service in a separate browser window to initiate the OAuth grant flow.
  • Set the SQL Engine Mode (SQLEngineMode) option to 2 (Direct).
    Note: The dynamic authorization code grant is supported only in Direct mode.
  • Set the Client ID (ClientID) option to specify the client ID key for your application.
  • Set the Client Secret (ClientSecret) option to specify the client secret for your application.
    Important: The client secret is a confidential value used to authenticate the application to the server. To prevent unauthorized access, this value must be securely maintained.
  • Set the Authorization URI (AuthURI) option to specify the endpoint for obtaining an authorization code.
  • Set the Token URI (TokenURI) option to specify the endpoint used to exchange authentication credentials for access tokens.
  • Set the Scope (Scope) option to specify a space-separated list of OAuth scopes to limit the permissions granted by the access token.
  • Set the Redirect URI (RedirectURI) option to specify the endpoint that the client is returned to after authenticating with a third-party service. Note that the value of the Redirect URI (RedirectURI) option must include the port number. For example, RedirectURI=http://localhost:80 or RedirectURI=http://localhost:8080.
  • Optionally, specify values for any additional options you want to configure. See "Connection option descriptions" for a complete list of options.

The following example demonstrates a basic session using the dynamic authorization code grant:

Connection URL:

Driver=DataDirect 8.0 Google BigQuery;
AuthenticationMethod=oauth2.0;EnableLoginPrompt=1;SQLEngineMode=2;
ClientID=abcdefghij1k2lmn3o4p5qr67s;ClientSecret=FaZBFRsGXTaR;
AuthURI=https://accounts.google.com/o/oauth2/auth;
TokenURI=https://accounts.google.com/o/oauth2/token;
Scope=https://www.googleapis.com/auth/bigquery;
RedirectURI=http://localhost:80;

odbc.ini File: 

Driver=ODBCHOME/lib/ivgbq28.so
...
Description=DataDirect 8.0 Google BigQuery
...
AuthenticationMethod=oauth2.0
...
EnableLoginPrompt=1
...
SQLEngineMode=2
...
ClientID=abcdefghij1k2lmn3o4p5qr67s
...
ClientSecret=FaZBFRsGXTaR
...
AuthURI=https://accounts.google.com/o/oauth2/auth
...
TokenURI=https://accounts.google.com/o/oauth2/token
...
Scope=https://www.googleapis.com/auth/bigquery
...
RedirectURI=http://localhost:80
...