Connect to Datasources

Last modified on July 12, 2024

This page provides instructions on how to configure everyday client applications (such as database clients) to connect to resources via StrongDM.

Connection Process

  1. Open StrongDM Desktop by clicking the sdm icon in the menu bar of your screen (macOS) or in the Windows taskbar.

  2. If you are already logged in to StrongDM, the desktop app displays a list of available resources. Click the name of the desired resource in the list.

  3. In the desktop app, ensure there is a green lightning bolt next to the resource name, meaning a healthy connection exists. If you are using the CLI instead, run sdm status to ensure the resource is listed as connected.

  4. Open your client application and enter the connection details.

  • Note that the connection values, such as hostname, username, password, and others, are different than usual because of the connection that StrongDM has already set up to your computer.
  • For most clients, the required hostname is localhost and the username and password fields can be left empty.
  • The known exceptions are described on this page. The reason for these exceptions is often that a graphical client’s form validation requires fields to have some value in them, rather than be left empty, even if the fields are not actually used to make the connection.
  1. Once you have filled in the appropriate connection details, if any, initiate the connection within your client and then interact with your resource as you normally would.

Client Connection Details

This section lists some of the clients that require connection values that differ from the defaults. When the indicated value for a given field is empty, leave the field empty. For any string, enter anything you want. The client’s form validation requires something to be written in that field, but the contents do not actually matter because the value is not used to make the connection.

Aurora MySQL, Clustrix, MariaDB, MySQL, SingleStore

ClientHostnameUsernamePasswordInitial DB
DBeaverlocalhostemptyemptyexisting database name
DbVisualizerlocalhostemptyemptyexisting database name
MySQL Workbench127.0.0.1any stringemptyempty
Sequel Pro127.0.0.1emptyemptyempty
SQLPro Studiolocalhostany stringemptyempty
SQLyoglocalhostany stringemptyempty
Tableau127.0.0.1emptyemptyempty
TeamSQLlocalhostany stringemptyempty

Aurora PostgreSQL, Citus, Greenplum, PostgreSQL

ClientHostnameUsernamePasswordInitial DB
DataGriplocalhostemptyemptyempty
Navicat (macOS)localhostany stringemptyempty
pgAdmin127.0.0.1any stringemptyany string
Posticolocalhostemptyemptyexisting database name
SQLPro Studiolocalhostany stringemptyempty
Tableaulocalhostany stringemptyany string
TablePluslocalhostemptyemptyexisting database name
TeamSQLlocalhostany stringemptyany string
SQL Workbench/Jlocalhostany stringany stringempty

Microsoft SQL Server

ClientHostnameUsernamePasswordInitial DBAdditional Settings
Access127.0.0.1any stringemptyempty
Alteryx Designer127.0.0.1any stringany stringemptyUse system ODBC connection and SQL Server 10.x driver
Azure Data Studio127.0.0.1any stringemptyemptySDM port should be separated by a comma with no spaces (for example, 127.0.0.1,11433); under Advanced… > Security set Trust server certificate to true
Excel127.0.0.1any stringemptyempty
Navicatlocalhostany stringemptyempty
SQL Server Management Studio127.0.0.1any stringany stringemptyChange Network Protocol to TCP/IP; Server Name should be the IP address; SDM port should be separated by a comma with no spaces (for example, 127.0.0.1,11433)
Tableau127.0.0.1any stringemptyempty

Neptune

ClientHostnameAdditional Settings
Gremlin ConsolelocalhostConfigure the client not to use TLS. In addition, configure the client to use GraphSON instead of Gryo.
Gremlin cURLlocalhostConfigure the client not to use TLS.
Gremlin SDKlocalhostConfigure the client not to use TLS. In addition, configure the client to use GraphSON instead of Gryo.
SPARQL cURLlocalhostConfigure the client not to use TLS.

Gremlin Console with Neptune

To use Gremlin Console with Neptune, edit a configuration file for Neptune (neptune-remote-sdm-graphson.yaml) to match the following:

hosts: [127.0.0.1]
port: 18182
connectionPool: { enableSsl: false }
serializer: { className: org.apache.tinkerpop.gremlin.driver.ser.GraphSONMessageSerializerV3d0 }

Then start Gremlin:

bin/gremlin.sh

Use the edited config to connect via TinkerPop, and then open Gremlin Console:

gremlin> :remote connect tinkerpop.server neptune-remote-sdm-graphson.yaml
gremlin> :remote console

Oracle

For additional details, see the Connect to Oracle guide.

ClientHostnameUsernamePassword
DBeaverlocalhostany stringpassword

Redshift

ClientHostnameUsernamePasswordInitial DBAdditional Settings
DataGriplocalhostany stringany stringemptyRequires modification of the JDBC URL with the following specific parameters: jdbc:redshift://localhost:port/any?ssl=false&UID=any&PWD=any; see the Redshift entry in JDBC Drivers
DbVisualizerlocalhostemptyemptyany stringnone
SQLPro Studiolocalhostany stringemptyemptynone
SQL Workbench/Jlocalhostany stringany stringemptynone
Tableaulocalhostany stringany stringany stringnone

Snowflake

ClientHostnameUsernamePasswordInitial DBAdditional Settings
DBeaver127.0.0.1any stringany stringemptySet any string for Account and false for SSL under Driver Properties

Db2 LUW

ClientHostnameUsernamePasswordInitial DB
DBeaverlocalhostany stringany stringany string
DbVisualizerlocalhostany stringany stringany string

Db2i

ClientHostnameUsernamePasswordInitial DBAdditional Settings
DBeaverlocalhostany stringany stringany stringFrom the Driver Properties settings, portNumber must be set to the SDM port-override value.
DbVisualizerlocalhostany stringany stringany stringLoad a driver compatible with DB2 iseries, such as jt400-10.4.jar. Once added, go to the Driver Properties and set the portNumber to the StrongDM port-override value.

Sybase ASE, Sybase IQ

The known exceptions to both sets of values are as shown:

ClientHostnameUsernamePasswordInitial DB
DBArtisanlocalhostany stringany stringempty
DataGriplocalhostany stringany stringempty
Dbeaverlocalhostany stringany stringempty
DBVisualizerlocalhostany stringany stringempty
ERStudiolocalhostany stringany stringempty
RapidSQL127.0.0.1any stringany stringempty
SQL Workbench/Jlocalhostany stringany stringempty

Command-line Clients

Database typeSample connection string with portSample connection string with database
BigQuerybq --api http://localhost:20000 --disable_ssl_validation ls
Cassandracqlsh localhost port
DynamoDBdynamodb --endpoint-url http://localhost:port
Microsoft SQL Serversqlcmd -s 127.0.0.1,portsqlcmd -s 127.0.0.1 -d <database>
mssql-cli -S 127.0.0.1,port -U sdm -P sdmmssql-cli -S 127.0.0.1 -U sdm -P sdm -d <database>
MongoDBmongo --host localhost --port port
MySQL, Aurora MySQL, MariaDB, SingleStoremysql -h 127.0.0.1 -P port
PostgreSQL, Aurora PostgreSQL, Citus, Greenplum, Redshiftpsql -h localhost -p portpsql -h localhost -d <database>
Redisredis-cli -h localhost -p port
SnowflakeSNOWSQL_PWD=none snowsql -u sdm -a sdm -d <database> -s <schema> -w <warehouse> -h localhost -p port -D protocol=http

Database Overrides

The SQL Server and PostgreSQL datasource types, as well as PostgreSQL derivatives like Greenplum and Redshift, have the option of database overrides. However, this option works differently between SQL Server and PostgreSQL.

Database override enabled

For PostgreSQL:

  • When a user connects to the datasource, they are unable to change databases from the database configured in the datasource.
  • If the user tries to change databases, the command appears to be successful but the user can only query the original datasource.
  • In this configuration, the user does not need to specify a database when connecting to the datasource via StrongDM.

For SQL Server:

  • When a user connects to the datasource, they automatically connect to the database specified in the datasource configuration.
  • In this configuration, the user does not need to specify a database when connecting to the datasource via StrongDM.

Database override disabled

For PostgreSQL and SQL Server:

  • If the Override Database option is not enabled, the user will be able to change databases as normal.
  • In this configuration, the user DOES need to specify a database, that is, any database that is accessible in the datasource, when connecting to the datasource via StrongDM.

JDBC Drivers

Some JDBC drivers have very specific connection string requirements. When using the following JDBC drivers, we recommend entering the connection string directly. Replace <port> with the configured port. Where it says any you can replace with any string, but a string must be there for proper functionality.

DriverConnection string
Athena (driver versions 2.0.5, 2.0.6)jdbc:awsathena://UseResultsetStreaming=0;ProxyHost=localhost;ProxyPort=port;Protocol=http;AwsRegion=us-any-1;UID=any;PWD=any;S3OutputLocation=s3://any/
jTDSjdbc:jtds:sqlserver://localhost:port/any;user=any;password=any;ssl=request
Redshiftjdbc:redshift://localhost:port/any?ssl=false&UID=any&PWD=any
Snowflakejdbc:snowflake://localhost:port/?account=any&SSL=FALSE

REST API Connections

Some database types allow REST API access. Druid requires it. To connect to these databases, replace the host and port in the URL with localhost and the configured port of your resource in StrongDM.

For example, with Druid use http://localhost:18090/druid/indexer/v1/task.

If you have trouble connecting with your database client, try the default values (hostname localhost and an empty username and password). If that does not work, check the tables on this page for specific values for your client.

Top