Connect to Datasources

This page provides instructions on how to configure everyday client applications (such as database clients) to connect to resources via StrongDM.

Connection Process

Open StrongDM Desktop by clicking the sdm icon in the menu bar of your screen (macOS) or in the Windows taskbar.
If you are already logged in to StrongDM, the desktop app displays a list of available resources. Click the name of the desired resource in the list.

If you wish to connect to a resource using the command-line interface (CLI) instead, open the command prompt or terminal and run sdm connect <RESOURCE_NAME>, being sure to replace the placeholder text with the actual resource name (for example, sdm connect test-mysql-db).

In the desktop app, ensure there is a green lightning bolt next to the resource name, meaning a healthy connection exists. If you are using the CLI instead, run sdm status to ensure the resource is listed as connected.
Open your client application and enter the connection details.
1. Note that the connection values, such as hostname, username, password, and others, are different than usual because of the connection that StrongDM has already set up to your computer.
2. For most clients, the required hostname is localhost and the username and password fields can be left empty.
3. The known exceptions are described on this page. The reason for these exceptions is often that a graphical client's form validation requires fields to have some value in them, rather than be left empty, even if the fields are not actually used to make the connection.
Once you have filled in the appropriate connection details, if any, initiate the connection within your client and then interact with your resource as you normally would.

Client Connection Details

This section lists some of the clients that require connection values that differ from the defaults. When the indicated value for a given field is empty, leave the field empty. For any string, enter anything you want. The client's form validation requires something to be written in that field, but the contents do not actually matter because the value is not used to make the connection.

Aurora MySQL, Clustrix, MariaDB, MySQL, SingleStore

For some versions of MySQL, you may need to specify that you do not wish to use SSL if SSL/No SSL is asked for by the client.

Client

Hostname

Username

Password

Initial DB

DBeaver

localhost

empty

existing database name

DbVisualizer

localhost

empty

existing database name

MySQL Workbench

127.0.0.1

any string

empty

Sequel Pro

127.0.0.1

empty

SQLPro Studio

localhost

any string

empty

SQLyog

localhost

any string

empty

Tableau

127.0.0.1

empty

TeamSQL

localhost

any string

empty

Aurora PostgreSQL, Citus, Greenplum, PostgreSQL

For DataGrip, the Authentication field should be set as User & Password, not pgpass.

Client

Hostname

Username

Password

Initial DB

DataGrip

localhost

empty

Navicat (macOS)

localhost

any string

empty

pgAdmin

127.0.0.1

any string

empty

any string

Postico

localhost

empty

existing database name

SQLPro Studio

localhost

any string

empty

Tableau

localhost

any string

empty

any string

TablePlus

localhost

empty

existing database name

TeamSQL

localhost

any string

empty

any string

SQL Workbench/J

localhost

any string

empty

ClickHouse

ClickHouse (TCP)

For ClickHouse (TCP) resource types, if the ClickHouse client is used to connect, as in the following example, then TLS certificate verification must be skipped.

clickhouse client --port 10092 --secure --config-file config/client-config.xml

If the above example is used, then the configuration file client-config.xml should look like the following:

<config>
    <openSSL>
        <client>
            <loadDefaultCAFile>true</loadDefaultCAFile>
            <cacheSessions>true</cacheSessions>
            <disableProtocols>sslv2,sslv3</disableProtocols>
            <preferServerCiphers>true</preferServerCiphers>
            <verificationMode>none</verificationMode>
            <invalidCertificateHandler>
                <name>AcceptCertificateHandler</name>
            </invalidCertificateHandler>
        </client>
    </openSSL>
</config>

ClickHouse (HTTP)

For ClickHouse (HTTP) resource types, when HTTPS is configured, TLS certificate verification must be skipped, as in the following example.

curl -G -d "query=SELECT%20303" https://127.0.0.1:10093 --insecure

Microsoft SQL Server

Client

Hostname

Username

Password

Initial DB

Additional Settings

Access

127.0.0.1

any string

empty

Alteryx Designer

127.0.0.1

any string

empty

Use system ODBC connection and SQL Server 10.x driver

Azure Data Studio

127.0.0.1,port

any string

empty

SDM port should be separated by a comma with no spaces (for example, 127.0.0.1,11433); under Advanced... > Security set Trust server certificate to true

Excel

127.0.0.1

any string

empty

Navicat

localhost

any string

empty

Power Pivot (Excel)

127.0.0.1,port

any string

empty

SDM port should be separated by a comma with no spaces (for example, 127.0.0.1,11433); In Advanced Settings, change Provider to: .NET Framework Data Provider for SQL Server

SQL Server Management Studio

127.0.0.1

any string

empty

Change Network Protocol to TCP/IP; Server Name should be the IP address; SDM port should be separated by a comma with no spaces (for example, 127.0.0.1,11433)

Tableau

127.0.0.1

any string

empty

Neptune

Client

Hostname

Additional Settings

Gremlin Console

localhost

Configure the client not to use TLS. In addition, configure the client to use GraphSON instead of Gryo.

Gremlin cURL

localhost

Configure the client not to use TLS.

Gremlin SDK

localhost

Configure the client not to use TLS. In addition, configure the client to use GraphSON instead of Gryo.

SPARQL cURL

localhost

Configure the client not to use TLS.

Gremlin Console with Neptune

To use Gremlin Console with Neptune, edit a configuration file for Neptune (neptune-remote-sdm-graphson.yaml) to match the following:

hosts: [127.0.0.1]
port: 18182
connectionPool: { enableSsl: false }
serializer: { className: org.apache.tinkerpop.gremlin.driver.ser.GraphSONMessageSerializerV3d0 }

Then start Gremlin:

bin/gremlin.sh

Use the edited config to connect via TinkerPop, and then open Gremlin Console:

gremlin> :remote connect tinkerpop.server neptune-remote-sdm-graphson.yaml
gremlin> :remote console

Oracle

For additional details, see the Oracle User Guide guide.

Client

Hostname

Username

Password

DBeaver

localhost

any string

password

SQL Developer

localhost

any string

password

SQLPlus

localhost

any string

password

Toad

localhost

any string

Redshift

See the JDBC Drivers section for information on how to use the Redshift JDBC driver. The connection string noted for Redshift is required to use Redshift via DataGrip.

Client

Hostname

Username

Password

Initial DB

Additional Settings

DataGrip

localhost

any string

empty

Requires modification of the JDBC URL with the following specific parameters: jdbc:redshift://localhost:port/any?ssl=false&UID=any&PWD=any; see the Redshift entry in JDBC Drivers

DbVisualizer

localhost

empty

any string

none

SQLPro Studio

localhost

any string

empty

none

SQL Workbench/J

localhost

any string

empty

none

Tableau

localhost

any string

none

Snowflake

Client

Hostname

Username

Password

Initial DB

Additional Settings

DataGrip

127.0.0.1

any string

empty

Set any string for Account and false for SSL under Driver Properties

DBeaver

127.0.0.1

any string

empty

Set any string for Account and false for SSL under Driver Properties

Db2 LUW

Client

Hostname

Username

Password

Initial DB

DBeaver

localhost

any string

DbVisualizer

localhost

any string

Db2i

Client

Hostname

Username

Password

Initial DB

Additional Settings

DBeaver

localhost

any string

From the Driver Properties settings, portNumber must be set to the SDM port-override value.

DbVisualizer

localhost

any string

Load a driver compatible with DB2 iseries, such as jt400-10.4.jar. Once added, go to the Driver Properties and set the portNumber to the StrongDM port-override value.

Sybase ASE, Sybase IQ

The known exceptions to both sets of values are as shown:

Client

Hostname

Username

Password

Initial DB

DBArtisan

localhost

any string

empty

DataGrip

localhost

any string

empty

Dbeaver

localhost

any string

empty

DBVisualizer

localhost

any string

empty

ERStudio

localhost

any string

empty

RapidSQL

127.0.0.1

any string

empty

SQL Workbench/J

localhost

any string

empty

Command-line Clients

Database type

Sample connection string with port

Sample connection string with database

BigQuery

bq --api http://localhost:20000 --disable_ssl_validation ls

Cassandra

cqlsh localhost port

DynamoDB

dynamodb --endpoint-url http://localhost:port

Microsoft SQL Server

sqlcmd -s 127.0.0.1,port

sqlcmd -s 127.0.0.1 -d <database>

mssql-cli -S 127.0.0.1,port -U sdm -P sdm

mssql-cli -S 127.0.0.1 -U sdm -P sdm -d <database>

MongoDB

mongo --host localhost --port port

MySQL, Aurora MySQL, MariaDB, SingleStore

mysql -h 127.0.0.1 -P port

PostgreSQL, Aurora PostgreSQL, Citus, Greenplum, Redshift

psql -h localhost -p port

psql -h localhost -d <database>

Redis

redis-cli -h localhost -p port

Snowflake

SNOWSQL_PWD=none snowsql -u sdm -a sdm -d <database> -s <schema> -w <warehouse> -h localhost -p port -D protocol=http

Database Overrides

The SQL Server and PostgreSQL datasource types, as well as PostgreSQL derivatives like Greenplum and Redshift, have the option of database overrides. However, this option works differently between SQL Server and PostgreSQL.

Database override enabled

For PostgreSQL:

When a user connects to the datasource, they are unable to change databases from the database configured in the datasource.
If the user tries to change databases, the command appears to be successful but the user can only query the original datasource.
In this configuration, the user does not need to specify a database when connecting to the datasource via StrongDM.

For SQL Server:

When a user connects to the datasource, they automatically connect to the database specified in the datasource configuration.
In this configuration, the user does not need to specify a database when connecting to the datasource via StrongDM.

Database override disabled

For PostgreSQL and SQL Server:

If the Override Database option is not enabled, the user will be able to change databases as normal.
In this configuration, the user DOES need to specify a database, that is, any database that is accessible in the datasource, when connecting to the datasource via StrongDM.

JDBC Drivers

Some JDBC drivers have very specific connection string requirements. When using the following JDBC drivers, we recommend entering the connection string directly. Replace <PORT> with the configured port. Where it says any you can replace with any string, but a string must be there for proper functionality.

Driver

Connection string

Notes

Athena (driver versions 2.0.5, 2.0.6)

jdbc:awsathena://UseResultsetStreaming=0;ProxyHost=localhost;ProxyPort=<PORT>;Protocol=http;AwsRegion=us-any-1;UID=any;PWD=any;S3OutputLocation=s3://any/

jTDS

jdbc:jtds:sqlserver://localhost:<PORT>/any;user=any;password=any;ssl=request

Redis

jdbc:redis:localhost:<PORT>

Redis Cluster

jdbc:redis:localhost:<PORT>

Must specify jdbc:redis: instead of jdbc:redis:cluster:; must specify verifyConnectionMode: false

Redshift

jdbc:redshift://localhost:<PORT>/any?ssl=false&UID=any&PWD=any

Snowflake

jdbc:snowflake://localhost:<PORT>/?account=any&SSL=FALSE

REST API Connections

Some database types allow REST API access. Druid requires it. To connect to these databases, replace the host and port in the URL with localhost and the configured port of your resource in StrongDM.

For example, with Druid use http://localhost:18090/druid/indexer/v1/task.

If you have trouble connecting with your database client, try the default values (hostname localhost and an empty username and password). If that does not work, check the tables on this page for specific values for your client.

Last updated 19 days ago

Was this helpful?