Managing connectors

Connectors are used to define data sources that the Continuous Compliance Engine can connect to and are grouped within environments. To navigate to the connectors screen, click on an environment and then click the Connectors tab.

The Connectors screen contains the following information and actions:

Meta Data Source: The source of the connector. E.g. Database, File, or Mainframe. The rows are grouped by Meta Data Source.
Connector ID: The numeric ID of the connector used to refer to the connector from the masking API.
Name: The name of the connector.
Type: The specific type of connector.
Edit: Edit the connector. See more details below.
Test Connection: Test the connector. See more details below.
Delete: Delete the connector. See more details below.

The rows on the screen can be filtered or sorted by Connector ID, Name and Type(filtering only) within each Meta Data Source group by clicking on the respective field. More information on grid filtering and sorting can be found here.

Missing Authentication

If an authentication is missing, an aptly named warning icon will show next to Name. Hover over the icon to identify if it’s missing the password, SSH key, credential path, or access keys.

Connections are not encrypted by default, but encryption can be enabled using TLS/SSL.For more information about connectors including features, versions and TLS setup, please refer to Data Source Support.

Database connectors

The fields that appear are specific to the DBMS Type you select. If you need assistance determining these values, please contact your database administrator.

Schema Name: The schema that contains the tables that this connector will access.
Database Name: The name of the database to which you are connecting. Note: the database name field is case-sensitive. It must match exactly with the name of the current database as known to the instance.
Host Name/IP: The network hostname or IP address of the database server.
Port: The TCP port of the server. For MS SQL Server, this is optional with the default set to 1433. If the server uses the default port, it does not need to be specified.
SID: (Oracle only) Oracle System ID (SID).
Instance Name: (MSSQL Server only) The name of the instance. This is optional. If the instance name is specified, the connector ignores the specified "Port" and attempts to connect to the "SQL Server Browser Service" on port 1434 to retrieve the connection information for the SQL Server instance. If the instance name is provided, be sure to make exceptions in the firewall for port 1434 as well as the particular port that the SQL Server instance listens to.
Custom Driver Name: (Generic only) The name of the JDBC driver class, including Java package name.
JDBC URL: (Generic and Advanced connector mode for Oracle, MS SQL Server, and Sybase only) The custom JDBC URL, typically including hostname/IP and port number.

Database connector properties

Getting properties

To retrieve all properties set on the connector, make a request to the GET database-connector/{id}/properties endpoint. This endpoint will respond with all default properties set by the driver, superimposed by any properties specified by an uploaded connection properties file. If a properties file is uploaded for a connector, this list can also be viewed through the UI on the database connector form, where you can sort by Property, Value, or Modified. The Modified field signifies whether the property value is the default or modified by the uploaded properties file.

The database name field is case-sensitive. It must match exactly with the name of the current database as known to the instance. Only a valid JDBC URL is required to retrieve properties of a connector; a valid connection to the database server is not necessarily required

Setting properties

Properties can sometimes be set through the JDBC URL or through a connection properties file. Customizing the JDBC URL is limited to Advanced, Generic, and Extended Connectors, while uploading a properties file is supported by all database connectors. All properties files must have the extension .properties and must adhere to Java properties file syntax. Even if a property specified in the properties file is not technically supported by the JDBC driver, it will still be passed along to the driver when building the JDBC Connection. All provided and unsupported properties will be logged whenever the properties file is loaded.

The properties file is assumed to be written using ISO 8859-1 character encoding.

Certain JDBC drivers do not allow specific supported properties to be set through the JDBC URL. For example, Caché DB does not support setting the schema property through the JDBC URL, so it must either be set through the extended connector's Schema form field or through a connection properties file. Please defer to specific Driver documentation to see how a property must be set.

When a property is defined in multiple places—such as a form field, the JDBC URL, or the properties file—the following hierarchy determines which value is applied:

Connector Form Fields (if applicable) for:
- Username
- Password
- Schema
For the remaining properties, the order of precedence is:
- Properties File (see image 3a)
- Connector Form Fields (see image 3b, if applicable) for:
  - Database name
  - Host
  - Port
  - SID
  - Instance name
  - JDBC URL
- JDBC URL (if applicable)

This means that for properties like Username, Password, and Schema, the Connector Form Fields take precedence. For all other properties, the order of precedence is: Properties File, Connector Form Fields, and then the JDBC URL.

Please note that the JDBC driver determines the precedence of duplicate properties specified in the URL, Properties object, and JDBC Connection API. Refer to the specific JDBC Driver documentation to confirm the exact order of precedence. A masking connector form will include either the fields from 3a or those from 3b, but not both, so duplication between these two sets is not possible.

Security considerations

The property key or value provided in a database connector's properties file will not be regulated and is subject to any user with CREATE or UPDATE connector privileges. This means that even supported sensitive properties such asuser, password, hostname, etc. will be available in plain text to anyone with theVIEW connectorprivilege.

If possible, specify sensitive properties through relevant form fields which will be obfuscated in all places or through the JDBC URL which will still be visible in plain text to any user with the VIEW connector privilege but will be redacted in support bundles.

File connectors

The following values appear when any of the file connector types are selected:

Connector Name: The name of the file connector (specific to your Delphix application and unrelated to the file itself).
Connection Mode:Filesystem Mount Point, SFTP, FTP, FTPS (only for mainframe datasets), AWS S3, Other S3 Compatible Storage, and Azure Blob Storage.

Due to networking complications in containerized masking, FTP and FTPS are currently disabled in containerized deployments. Delphix is researching options to re-enable FTP (for containerized masking) at a future date.

The rest of the values appear based on the selected Connection Mode value.

For Filesystem Mount Point connection mode, refer to the corresponding section on the Managing Remote Mounts page.

For AWS S3 & Other S3 Compatible Storage connection modes, refer to the corresponding section on the Amazon Simple Storage Service (S3) connector for files page.

For Azure Blob Storage connection mode, refer to the corresponding section on the Azure Blob Storage connector for files page.

For SFTP,FTP & FTPS connection modes, the following values appear under the credential step:

Path: The path to the directory where the file(s) are located.
Server Name: The name of the server used to connect to the file.
Port: The port used to connect to the server.
User Name: The user name to connect to the server.
Password: (non-Public Key Authentication only) The associated password for the server.
Public Key Authentication: (Optional) (Only appears for SFTP) Select this from ‘Select Authentication Type’ dropdown to specify a public key. Use the following instructions in this Knowledge base article to complete.

If you plan to do on-the-fly masking, you will need to create a separate environment and connector as the source for the files to be masked. The masked files will be put into the directory being pointed to by the connector created previously (the target). However, the file path specified in the connector of the target rule set must point to an existing file the target directory. It does not have to be a copy of the file, just an entry in the directory with the same name. It will be replaced by the masked file.

Starting with version 6.0.9.0 the SFTP mode is extended with the User Directory as root flag. If the Path defined is relative to the User-home-dir as configured on the SFTP Server, select the flag below.

If the connector is configured via the API then that flag is accessible as userDirIsRoot, for example:

{
    "connectorName": "Test SFTP Connector",
    "environmentId": 2,
    "fileType": "DELIMITED",
    "connectionInfo": {
        "connectionMode": "SFTP",
        "path": "/delimited",
        "host": "yourSFTPServer",
        "loginName": "xxxxx",
        "password": "xxxxx",
        "port": 22,
        "userDirIsRoot": true
    }
}

Limitations

S3 Role-based connectivity is restricted to Continuous Compliance instances hosted on AWS EC2. Connectivity attempts from outside the AWS environment using this method will result in connection failures.