Authenticate Database Sources
You are adding a database source in Data Fusion. The C3 Agentic AI Platform needs permission to query your database. Each database connector accepts one or more sign-in methods. Choose the method your database supports, gather the connection details and credentials it needs, and enter them in the connector wizard. The Credential fields by connector section lists the exact fields for each connector. Use the C3 DataLake, the platform's built-in data lakehouse, when the data already lives in the platform.
A connector is the connection the wizard creates to one database. The connector appears on the Data Fusion canvas as a Source System node, and every pipeline that reads from that database starts from it.
Find the Authentication step
Open the connector wizard from Data > Data Fusion, then select Add Data Source and pick a connector. Most database connectors have five steps:
- Connector: choose the database, such as Snowflake or Postgres.
- Destination: name the connector and give the connection details, such as the server, port, and database.
- Authentication: choose an Authentication Method, where the connector offers more than one, and enter the credentials. A connector with one sign-in method has no Authentication Method choice.
- Advanced: optional connection settings, such as transport encryption and timeouts.
- Review: check the values, then select Save & Test or Save & Close.
The wizard shows the Advanced step only for connectors that have advanced settings. Snowflake and Oracle have no Advanced step, so their wizards have four steps. The C3 DataLake has no Authentication or Advanced step; see the C3 DataLake section of this page.
The wizard checks the connection details and credentials against the database when you run Save & Test. Save & Test saves the connector and its credentials first, then tests the connection. If the test fails, the connector stays saved. The wizard shows an AI Error Analysis summary of the likely cause, such as a wrong account address, an unreachable server, or an incorrect secret. Because the connector is already saved, correct the value in the saved connector:
- Close the wizard.
- On the canvas, select the connector's SQL Source System node to reopen it.
- Correct the value the summary names.
- Run Save & Test again.
- Select Save Changes.
The wizard hides secret values, such as passwords, private keys, tokens, and client secrets. To change the credentials of a saved connector, select its SQL Source System node on the canvas to open the edit wizard. The wizard opens on the Connector step; select Authentication in the step list. Stored secrets show as a masked value. To replace a secret, select the pencil icon (Edit credential) next to it and enter the new value. Select Save & Test to check the connection, and select Save Changes to finish.
Authentication strategies
Database connectors offer more sign-in methods than file connectors. A database can run on your own servers, in a cloud data warehouse, or as a software-as-a-service (SaaS) application. Each method follows one of these strategies:
| Strategy | What it is | You provide | Connectors and methods |
|---|---|---|---|
| Username and password | A login for a database account | A username and password | PostgreSQL, SAP HANA, and SQL Server (their only method); ServiceNow Basic; MariaDB Password |
| Key pair | A public key registered with the database; the platform signs in with the matching private key, so no shared password is sent | A private key in PEM format, and its passphrase if the key is encrypted | Snowflake Key Pair |
| Access token | A token that the provider issues for programs, used in place of a password | A programmatic access token or a personal access token | Snowflake Programmatic Access Token, Databricks Personal Access Token |
| OAuth application | A client application that you register with the provider, which signs in as itself or on behalf of a user through OAuth | A client ID and secret, plus a token, a refresh token, or a certificate | BigQuery O Auth and O Auth JWT; Databricks O Auth U2 M, O Auth M2 M, Azure Service Principal, and Azure AD; ServiceNow O Auth, O Auth Password, and O Auth JWT; MariaDB Azure AD |
| Managed or workload identity | No stored secret: the platform signs in with a cloud identity that your cloud administrator grants to the environment that runs your application | Nothing, or a workload identity configuration | BigQuery GCP Instance Account, AWS Workload Identity, and Azure Workload Identity; Databricks Azure MSI; MariaDB Azure MSI |
| Directory or single sign-on | Sign-in delegated to your organization's identity provider or directory service | A username and password plus the identity provider's sign-in URL and settings | ServiceNow OKTA, ADFS, One Login, and Ping Federate; MariaDB NTLM, LDAP, and Azure Password |
The C3 DataLake needs no credentials, because the data already lives in the platform.
Choose an authentication strategy
Pick the strategy that matches where your database runs and what your provider lets you issue:
- Cloud warehouse in the same cloud as your application: use a managed or workload identity where the connector offers one. Examples are BigQuery GCP Instance Account and Databricks Azure MSI. You store no long-lived secret. Ask your cloud administrator which cloud runs your application and whether its identity has access to the database.
- Cloud or SaaS database that your organization reaches across clouds: use an OAuth application. The credential belongs to an application you control, not to a person, so it survives staff changes. You can also limit the credential to the schemas you need.
- Snowflake: use Key Pair or Programmatic Access Token. The Snowflake connector offers no password method.
- Database that offers only a username and password: use a dedicated database account with read-only access, and change its password on a schedule.
- Organization that signs in through an identity provider such as Okta or ADFS: use the matching single sign-on method where the connector offers one.
- Data already in the platform: use the C3 DataLake and skip credentials.
Whatever the strategy, enter secrets only on the Authentication step of the connector or with setCredentials from the C3 AI Console. Never put secrets in transforms, package files, or committed source. Credentials stay in the environment where you enter them and do not promote with the package, because publishing removes the fields marked secret. Enter the credentials again in each environment. Run Save & Test again after you replace a credential.
Gather connection details and credentials
Collect these before you open the wizard:
- A connector name: letters, digits, and underscores, not starting with a digit. No other source system in your application, whether database, file, or streaming, can use the same name.
- The connection details: the server or account URL, the port, and the database. The Destination step can also ask for a warehouse, project, dataset, catalog, HTTP path, or instance URL.
- Network access: the environment that runs your application must reach the database server through any firewall, private network, or IP allowlist. An unreachable server fails Save & Test even with correct credentials.
- A database identity with read access: the account that the credential represents needs read (
SELECT) access to the schemas and tables you load. The connector only reads from the source database. You can load data incrementally with change data capture (CDC). In that case, the identity also needs read access to every column that orders the changes, such as a last-updated timestamp. - The credential for your chosen strategy: a password, a private key, an access token, an OAuth client ID and secret, or the identity provider details. For a managed identity, your cloud administrator grants the identity access, and you enter nothing.
- Transport encryption settings, if your network requires them: most connectors have these on the Advanced step. An example is Encrypt connection for SAP HANA and SQL Server.
Credential fields by connector
Each connector offers these sign-in methods. The labels match what the wizard shows.
| Connector tile | Wizard steps | Authentication methods |
|---|---|---|
| Snowflake | 4 (no Advanced) | Key Pair, Programmatic Access Token |
| Postgres | 5 | Username and password (one sign-in method) |
| Big Query | 5 | O Auth, O Auth JWT, GCP Instance Account, AWS Workload Identity, Azure Workload Identity |
| Delta Lake (Databricks) | 5 | Personal Access Token, O Auth U2 M, O Auth M2 M, Azure Service Principal, Azure AD, Azure MSI |
| HANA | 5 | Username and password (one sign-in method) |
| ServiceNow | 5 | Basic, O Auth, O Auth Password, O Auth JWT, OKTA, ADFS, One Login, Ping Federate |
| SQL Server | 5 | Username and password (one sign-in method) |
| C3 DataLake | 3 (no Authentication) | None |
Snowflake
Destination fields: Database (required), Account URL (required, such as your-account.snowflakecomputing.com), Port (default 443), Schema, and Warehouse (required).
Snowflake offers two values for Authentication Method. Both start with Username (required), the Snowflake username:
- Key Pair:
- Upload private key file: select your
.p8key file, and the wizard fills Private key (PEM) from it. - Private key (PEM) (required): the private key in PEM format. Paste the full contents of the key file, including the
-----BEGIN PRIVATE KEY-----and-----END PRIVATE KEY-----lines. An encrypted key starts with-----BEGIN ENCRYPTED PRIVATE KEY-----instead. - Private key passphrase: the passphrase of an encrypted private key. Leave it blank for an unencrypted key.
- Upload private key file: select your
- Programmatic Access Token:
- Programmatic access token (required): the token that Snowflake issued for the user.
PostgreSQL
Destination fields: Database (required), ServerEndpoint (required), the host name or IP address of the server, and Port (required, default 5432).
PostgreSQL has one sign-in method. Its Authentication step has these fields:
- Username (required): the user that signs in to PostgreSQL.
- Password (required): the password of that user.
Advanced: the SSL setting encrypts the connection to PostgreSQL with SSL/TLS.
Google BigQuery
Destination fields: ProjectId, BillingProjectId, and DatasetId.
BigQuery offers five values for Authentication Method:
- O Auth: an OAuth client.
- OAuthClientId and OAuthClientSecret (required).
- Optional token fields, such as OAuthAccessToken, and InitiateOAuth, which defaults to
OFF.
- O Auth JWT: a Google service account that signs in with a JSON Web Token (JWT).
- OAuthClientId, OAuthClientSecret, and OAuthJWTCert (required).
- OAuthJWTCertType (required): defaults to
GOOGLEJSON, for a Google service account JSON key. - Optional: RequestingServiceAccount, DelegatedServiceAccounts, OAuthJWTCertPassword, OAuthJWTCertSubject, OAuthJWTIssuer, and OAuthJWTSubject.
- GCP Instance Account: the Google Cloud service account of the environment that runs your application. This method has no fields.
- AWS Workload Identity and Azure Workload Identity: a workload identity from Amazon Web Services or Microsoft Azure.
- AWSWorkloadIdentityConfig or AzureWorkloadIdentityConfig (required): the workload identity configuration.
- Optional: WorkloadPoolId, WorkloadProviderId, and WorkloadProjectId.
Databricks
Databricks is the Delta Lake tile in the connector list.
Destination fields: Server (required), the host name with :port appended; HTTPPath (required); Database; Catalog; and ProtocolVersion.
Databricks offers six values for Authentication Method:
- Personal Access Token: Token (required), a Databricks personal access token.
- O Auth U2 M: OAuth user-to-machine sign-in. OAuthClientId and CallbackURL (required), plus optional OAuth Level, Databricks Account ID, and refresh token fields.
- O Auth M2 M: OAuth machine-to-machine sign-in. OAuthClientId and OAuth Client Secret (required), plus optional OAuth Level, Databricks Account ID, and OAuth Refresh Token.
- Azure Service Principal: an application registered in Microsoft Entra ID, formerly Azure Active Directory (Azure AD). AzureTenantId, AzureClientId, AzureClientSecret, and Azure Tenant (for auth) (all required).
- Azure AD: OAuth sign-in on behalf of a Microsoft Entra ID user. AzureTenantId, OAuthClientId, and CallbackURL (required), plus optional Azure Tenant (for auth), OAuth Level, and OAuth Refresh Token.
- Azure MSI: the Azure managed service identity (MSI) of the environment that runs your application. This method has no fields.
SAP HANA
Destination fields: Database, Server (required), and Port. SAP HANA uses port 39013 for the system database by default, and 3NN15 for a tenant database, where NN is the SAP HANA instance number.
SAP HANA has one sign-in method. Its Authentication step has these fields:
- Username (required): the SAP HANA database username.
- Password (required): the password for that user.
Advanced: Encrypt connection turns on TLS encryption. The step also has Auto reconnect and Timeout (seconds).
ServiceNow
Destination fields: URL (required), the base URL of your ServiceNow instance.
ServiceNow offers eight values for Authentication Method:
- Basic: User and Password (required).
- O Auth: OAuthClientId, OAuthClientSecret, and OAuthAccessToken (required), plus InitiateOAuth, which defaults to
OFF. - O Auth Password: User, Password, OAuthClientId, and OAuthClientSecret (required), plus InitiateOAuth.
- O Auth JWT: OAuthJWTCert, OAuthJWTCertType (default
USER), OAuthJWTIssuer, and OAuthJWTSubject (required), plus optional certificate and token settings. - OKTA, ADFS, One Login, and Ping Federate: sign-in through the named identity provider. User, Password, SSOLoginURL, and SSOProperties (required), plus optional CredentialsLocation.
SQL Server
Destination fields: Database, Server (required, such as myserver.database.windows.net), and Port, the TCP port SQL Server listens on.
SQL Server has one sign-in method. Its Authentication step has these fields:
- Username (required): the SQL Server login name.
- Password (required): the password for that login.
Advanced: Encrypt connection turns on TLS encryption. Encrypt connection is off by default, and Azure SQL requires encryption. The step also has Trust server certificate, Login timeout (seconds), and Hostname in certificate.
C3 DataLake
The C3 DataLake is the platform's built-in data lakehouse, which holds data that already lives in the platform. Its wizard has three steps: Connector, Destination, and Review and Save. On Destination, pick a Catalog (required) from the DataLake catalogs available to your application. On Review and Save, select Save & Close. The wizard has no Authentication step and no Save & Test, because there is no external system to sign in to.
After you save the connector, select the Table placeholder node attached to the connector on the canvas. The Select Source Table dialog opens. Choose Create new or Use existing, then select a table from Tables. The dialog creates a source collection for the table. When you select a table, the dialog shows a preview of its first 20 rows. Each source collection reads one table, so add one collection for each table that you need.
Microsoft Fabric
Destination fields: Database, Server (required), the Microsoft Fabric SQL endpoint host name, and Port.
Microsoft Fabric has one sign-in method, a service principal. Its Authentication step has these fields:
- Client ID (required): the application (client) ID of the service principal.
- Client secret (required): a client secret of that application.
Advanced: Encrypt connection turns on TLS encryption.
MariaDB and other connectors
Data Fusion also lists many more database connectors, grouped by category, such as Relational Databases, Big Data & NoSQL, and ERP & CRM. The Relational Databases category holds Informix, MariaDB, Microsoft Fabric, SQL Server, Sybase, and Sybase IQ. These connectors use the same wizard, and their methods follow the same strategies. The methods differ by connector, and not every connector offers a password method.
MariaDB is a typical example. Its Authentication Method offers Password, NTLM, Azure AD, Azure Password, Azure MSI, and LDAP, and its Authentication step also has a UseSSL setting.
See also
- Configure SQL Sources
- Connect with SQL Source System
- Authenticate File Sources
- Authenticate Streaming Sources
- Data Integration Overview
- JdbcCredentials and TlsCertificate, for JDBC credential and certificate fields