Auth Model Reference

Table of contents

• How to configure authentication
• All auth models

The auth-model field in a connection's configuration selects the authentication method. The keys you put in auth-properties depend on the selected model. For information on all available auth-properties IDs, see All auth models.

Note: auth-properties only appears in data-sources.json when you pre-configure credentials manually. After the first connection with save-password: true, CloudBeaver encrypts the credentials and removes auth-properties from the file. In a working connection you'll only see auth-model - the credentials are in the encrypted store.

How to configure authentication

Here is an example of a common auth model.

To set up username and password authentication, specify the ID that matches your database. Use native for most standard connections like PostgreSQL or MySQL. If you use a specific database, choose its dedicated ID from the list below.

Once you select the appropriate ID, add the following fields to your configuration:

Field	Description
userName	Database username
userPassword	Database password

Example:

{
  "auth-model": "native",
  "auth-properties": {
    "userName": "postgres",
    "userPassword": "secret"
  }
}

All auth models

This table lists every auth model registered in CloudBeaver, with the auth-properties field names each one accepts.

Auth model ID	Name	auth-properties fields
azure_ad_cosmos_nosql	Microsoft Entra ID for Cosmos DB for NoSQL	azureGroupName, useLegacyToken
azure_ad_mysql	Microsoft Entra ID for MySQL	azureGroupName, useLegacyToken
azure_ad_postgresql	Microsoft Entra ID for PostgreSQL	azureGroupName, useLegacyToken
azure_ad_sqlserver	Microsoft Entra ID for SQL Server	-
azure_ad_timescaledb	Microsoft Entra ID for Timescale	azureGroupName, useLegacyToken
cosmos-key	Cosmos DB account key	key
databricks_m2m	OAuth (Machine to Machine)	clientSecret, clientId, httpPath
databricks_oauth	Databricks personal access token	personalAccessToken, httpPath
databricks_sso	Databricks OAuth (User to Machine) Web	clientId, clientSecret, httpPath
databricks_u2m	OAuth (User to Machine)	httpPath
db2_entra_web	DB2 Microsoft Entra ID (Web)	tenantId, clientId, clientSecret, scope, sslCertificate
db2_entraid	DB2 Microsoft Entra ID	tenantId, clientId, clientSecret, scope, sslCertificate
db2_krb5	DB2 Kerberos	userName, userPassword, krbRealmName, cacheFilePath, krb5ConfPath, krbUserName, kdcServer, useKeytab, keytabPath, useKinit
documentdb_default	DocumentDB authentication	userName, userPassword
ferretdb_default	FerretDB authentication	userName, userPassword, sourceDatabase, mechanism
gcp_cloud_iam_alloydb	Google Cloud IAM (AlloyDB)	userName, userPassword, clientId, clientSecret, refreshToken, authType, serviceAccountConfig
gcp_cloud_iam_bigquery	Google Cloud IAM (BigQuery)	clientId, clientSecret, refreshToken, authType, serviceAccountConfig
gcp_cloud_iam_bigtable	Google Cloud IAM (Bigtable)	clientId, clientSecret, refreshToken, authType, serviceAccountConfig
gcp_cloud_iam_firestore	Google Cloud IAM (Firestore)	clientId, clientSecret, refreshToken, authType, serviceAccountConfig
gcp_cloud_iam_spanner	Google Cloud IAM (Spanner)	clientId, clientSecret, refreshToken, authType, serviceAccountConfig
gcp_sql_iam	Google Cloud IAM	userName, userPassword, clientId, clientSecret, refreshToken, authType, serviceAccountConfig
google_bigquery	Google Cloud Auth	userName, userPassword
google_spanner	Google Cloud Auth	userName, userPassword
iam	AWS RDS IAM	userName, region, awsAccessKey, awsSecretKey, awsSessionToken, awsAssumeAccountId, awsAssumeRoleName, awsExternalId, secretName, crossAccountAccess, defaultAwsCredentials, awsServerEndpoint, sessionCredentials
iam_athena	AWS Athena IAM	awsAccessKey, awsSecretKey, awsSessionToken, awsAssumeAccountId, awsAssumeRoleName, awsExternalId, secretName, crossAccountAccess, defaultAwsCredentials, awsServerEndpoint, sessionCredentials
iam_dsql	Aurora DSQL Auth	awsAccessKey, awsSecretKey, awsSessionToken, awsAssumeAccountId, awsAssumeRoleName, awsExternalId, secretName, crossAccountAccess, defaultAwsCredentials, awsServerEndpoint, sessionCredentials
iam_keyspaces	AWS Keyspaces IAM	userName, region, awsAccessKey, awsSecretKey, awsSessionToken, awsAssumeAccountId, awsAssumeRoleName, awsExternalId, secretName, crossAccountAccess, defaultAwsCredentials, awsServerEndpoint, sessionCredentials
iam_neptune	AWS Neptune IAM	region, awsAccessKey, awsSecretKey, awsSessionToken, awsAssumeAccountId, awsAssumeRoleName, awsExternalId, secretName, crossAccountAccess, defaultAwsCredentials, awsServerEndpoint, sessionCredentials
iam_simple	AWS IAM	awsAccessKey, awsSecretKey, awsSessionToken, awsAssumeAccountId, awsAssumeRoleName, awsExternalId, secretName, crossAccountAccess, defaultAwsCredentials, awsServerEndpoint, sessionCredentials
iam_timestream	AWS Timestream IAM	awsAccessKey, awsSecretKey, awsSessionToken, awsAssumeAccountId, awsAssumeRoleName, awsExternalId, secretName, crossAccountAccess, defaultAwsCredentials, awsServerEndpoint, sessionCredentials
influx2_token	InfluxDB token	-
krb5	Kerberos	userName, userPassword, krbRealmName, cacheFilePath, krb5ConfPath, krbUserName, kdcServer, useKeytab, keytabPath, useKinit
libsql_token_jdbc	LibSQL Authentication	userPassword
mongodb_default	MongoDB authentication	userName, userPassword, sourceDatabase, mechanism
mysql_krb5	MySQL Kerberos	userName, userPassword, krbRealmName, cacheFilePath, krb5ConfPath, krbUserName, kdcServer, useKeytab, keytabPath, useKinit
native	Username/password	userName, userPassword
oceanbase_native	Oceanbase Native	userName, userPassword
oracle_entraid	Oracle Microsoft Entra ID	tenantId, clientId, clientSecret, scope, walletArchive
oracle_krb5	Oracle Kerberos	userName, userPassword, krbRealmName, cacheFilePath, krb5ConfPath, krbUserName, kdcServer, useKeytab, keytabPath, useKinit
oracle_native	Username/password	userName, userPassword
oracle_os	Oracle OS authentication	-
oracle_wallet	Oracle Wallet	userName, userPassword, walletArchive
postgres_pgpass	PostgreSQL PgPass	userName
postgres_sspi	PostgreSQL SSPI (Windows SSO)	userName, userPassword
postgresql_krb5	PostgreSQL Kerberos	userName, userPassword, krbRealmName, cacheFilePath, krb5ConfPath, krbUserName, kdcServer, useKeytab, keytabPath, useKinit
prestodb_krb5	PrestoDB Kerberos	userName, userPassword, krbRealmName, cacheFilePath, krb5ConfPath, krbUserName, kdcServer, useKeytab, keytabPath, useKinit
prestosql_krb5	PrestoSQL Kerberos	userName, userPassword, krbRealmName, cacheFilePath, krb5ConfPath, krbUserName, kdcServer, useKeytab, keytabPath, useKinit
profile	DBeaver profile	profile
redis_password	Sentinel Authentication	userName, userPassword, nodePassword
redshift_iam	AWS Redshift IAM	userName, region, awsAccessKey, awsSecretKey, awsSessionToken, awsAssumeAccountId, awsAssumeRoleName, awsExternalId, secretName, crossAccountAccess, defaultAwsCredentials, awsServerEndpoint, sessionCredentials
salesforce	Salesforce password authentication	userName, userPassword, authToken
salesforce_cdp_oauth	Salesforce authentication	userName, userPassword, clientId, clientSecret
salesforce_oauth	Salesforce OAuth authentication	clientSecret, clientID
snowflake_externalbrowser	Snowflake SSO (Browser)	userName, userPassword, role
snowflake_key	Snowflake private key	userName, encodedPrivateKey, passphrase, role
snowflake_oauth	Snowflake OAuth	clientId, clientSecret, authUrl, tokenUrl, scope
snowflake_pro	Snowflake username/password	userName, userPassword, role
snowflake_snowflake	Snowflake username/password	userName, userPassword, role
sqlserver_ad_integrated	Active Directory - Integrated	userName, userPassword
sqlserver_ad_password	SQL Server Active Directory - Password	userName, userPassword
sqlserver_custom	SQL Server custom Authentication	userName, userPassword
sqlserver_database	SQL Server Authentication	userName, userPassword
sqlserver_kerberos	SQL Server Kerberos Authentication	userName, userPassword, krbRealmName, cacheFilePath, krb5ConfPath, krbUserName, kdcServer, useKeytab, keytabPath, useKinit
sqlserver_mfa	Active Directory - MFA	userName, userPassword
sqlserver_msi	Active Directory - MSI	userName
sqlserver_ntlm	SQL Server NTLM	userName, userPassword
sqlserver_windows	Windows Authentication	userName, userPassword
teradata_LDAP	LDAP Mechanism	userName, userPassword
teradata_SSO	Teradata single sign-on	userName, userPassword
teradata_krb5	Teradata Kerberos Authentication	userName, userPassword, krbRealmName, cacheFilePath, krb5ConfPath, krbUserName, kdcServer, useKeytab, keytabPath, useKinit
tfa	Two-factor authentication	userName, userPassword
trino_krb5	Trino Kerberos	userName, userPassword, krbRealmName, cacheFilePath, krb5ConfPath, krbUserName, kdcServer, useKeytab, keytabPath, useKinit
yellowbrick_oauth2	Yellowbrick OAuth2	clientSecret, issuer, clientID