This guide covers the initial launch, management, and maintenance of CloudBeaver in cloud environments, including server configuration, updates, and backups.

After launching your cloud instance, follow these steps to access the product:

1. In your browser, go to
   http://<Instance_IP>/
   , where
   <Instance_IP>
   is the public IP address of your cloud instance.

Tip: If you’re unsure how to find your instance’s public IP, refer to the relevant cloud provider’s documentation.

2. You’ll be redirected to the product’s initial configuration wizard, which will guide you through the setup process.

For more detailed instructions on configuring the product, see Administration guide.

CloudBeaver provide a server manager utility to help you manage your server. You can use it to start, stop, update, configure, and back up the server.

For CloudBeaver the manager utility is available by default in cloud deployments.

To see available commands and options, enter the relevant command for your product:

product help

Note: Replace

product

with either

cloudbeaver

or

dbeaver-te

.

To start or stop the server, use the

• Start the server:

  
  product start
  
  

• Stop the server:

  
  product stop
  
  

Note: Replace

product

with either

cloudbeaver

or

dbeaver-te

.

To update your product version, follow these steps:

1. Connect to your server via SSH.
2. Check available versions:

   
   product update list
   
   

3. Choose the version you want to update.
4. Run the update command:

   
   product update %version%
   
   

Note: Replace

product

with either

cloudbeaver

or

dbeaver-te

.

You can easily make backups of your cluster’s state, which includes service volumes, database dumps, and internal certificates.

• Create a backup:

  
  product createBackup
  
  

  Additional options:

  • --include-certs
    : Includes internal certificates in the backup (disabled by default for security).
  • --skip-db-service
    : Skips the database dump if you are using an external database.

• Restore from backup:

  
  product restoreBackup
  
  

  Ensure your cluster is running before restoring from backup.

Note: Replace

product

with either

cloudbeaver

or

dbeaver-te

.

You can change the configuration of the server through the server manager. To update the

product configure

Once you’ve made changes, press Ctrl+S to save and Ctrl+X to exit the editor.

Note: Replace

product

with either

cloudbeaver

or

dbeaver-te

.

Note: This feature is available in Enterprise, AWS, Team editions only.

Microsoft Entra ID (formerly Azure AD) is a cloud-based identity and access management solution. It secures user authentication, enforces access policies, and enables single sign-on (SSO) for CloudBeaver.

For details, see the Microsoft Entra ID documentation.

Make sure you have:

• An active Azure account with the appropriate permissions.

• Access to the Microsoft Entra admin center.

1. As an administrator, go to Settings -> Server Configuration.

2. Find and activate the Microsoft Entra ID option in the Configuration section.

   

Tip: For more information on Server Configuration, see Server configuration administration

To enable authorization with the Microsoft platform, you need a registered application in Azure. If one doesn’t exist, create and configure it as follows:

1. Register an application
   Create a new enterprise application in Microsoft Entra by following the steps in the official Microsoft documentation.

2. Configure application secrets CloudBeaver uses the OpenID Connect protocol for authorization with Microsoft Entra ID. To enable this, configure application secrets. Detailed instructions are available in the official Microsoft documentation.

   Important: Record the value of the client secret immediately after creating it. It can only be viewed once. If you miss this step, you’ll need to create a new secret.

To enhance functionality, CloudBeaver can read and display the user’s first and last name from the OpenID token. To enable this, add the family_name and given_name fields to the response token.

Follow the steps in the official Microsoft documentation to configure optional claims.

Tip: Adding these fields ensures a more personalized user experience by displaying the full name in the application.

1. As an administrator, navigate to Settings -> Identity Providers.

2. Click on the + Add button.

3. Fill in the following fields:

   

Tip: Ensure you have configured the application with the required permissions in Microsoft Entra to retrieve user information and group details. For additional details, see the Microsoft Entra ID documentation.

4. Click on the Create button.

5. Copy Redirect link:

   1. Enter the newly created identity provider.
   2. Copy the Redirect link.
   3. Add a Redirect link to the application in Microsoft Entra (select Web as platform) – official Microsoft documentation

1. Once the Microsoft Entra ID configuration is complete, navigate to the login screen to test authentication.

2. Select the Federated authentication method, labeled with the Configuration name you specified.

   

3. Verify the integration of Microsoft Entra ID

   1. Once logged in, click on your username in CloudBeaver and navigate to the User Info tab.
   2. Here, you should see tokens. Their presence indicates that the integration of Microsoft Entra ID has been successfully completed, and CloudBeaver has access to the necessary credentials.

   

Note: This feature is available in Enterprise, AWS, Team editions only.

NTLM (NT LAN Manager) Authentication is a protocol used by Microsoft to authenticate users and provide secure network communications. NTLM uses a challenge-response mechanism for authentication, where the user credentials are never sent over the network directly. For detailed setup and configuration of NTLM, refer to the official NTLM documentation.

1. As an administrator, go to Settings -> Server Configuration.

2. Find and activate the NTLM option in the Configuration section.

   

3. Save the changes.

1. As an administrator, navigate to Settings -> Identity Providers.

2. Click on the + Add button.

3. Fill in the following fields:

   

4. Click on the Create button.

1. With the NTLM configuration now established, proceed to the login screen.

2. Select the NTLM authentication method, labeled with the Configuration name you specified.

   

3. Fill in your User name and User password to log in.

Note: This feature is available in Enterprise, AWS, Team editions only.

Okta OpenID Authentication utilizes Okta as an identity provider to authenticate users in applications through OpenID Connect. It simplifies user access control by providing a centralized authentication mechanism, thereby reducing the need for separate account and password management. For detailed setup and configuration instructions for Okta OpenID Connect, refer to the official Okta documentation.

1. As an administrator, go to Settings -> Server Configuration.

2. Find the Okta OpenID option in the Authentication Settings section and activate this setting to enable Okta OpenID authentication.

   

3. Save the changes.

1. As an administrator, navigate to Settings -> Identity Providers.

2. Click on the + Add button.

3. Fill in the following fields:

   

   Field	Description
   Provider	Select Okta OpenID from the dropdown menu.
   ID	Enter a unique identifier for the configuration.
   Configuration name	Enter a descriptive name for this configuration.
   Description	Provide a brief description of this identity provider configuration.
   Icon URL	Enter the URL of an icon to represent this provider.
   Disabled	Leave unchecked to enable this identity provider.
   Client ID	The client identifier provided by the OpenID Connect provider.
   Client Secret	A secret key associated with the client ID for authentication.
   Okta Domain	Organization domain in Okta.
   Read Okta group information	If checked than Active Directory user group information will be claimed. May be required for Okta permissions integration.
   Read user info	Read user profile data, using userinfo endpoint URL.
   Custom scopes	The custom scopes. Use with ; delimiter.
   Name of an AWS role claim	Name of the AWS role claim that contains the name of the AWS role.

4. Click on the Create button.

5. Copy Redirect and Sign out Links:

   1. Enter the newly created identity provider.
   2. Copy the Redirect link and the Sign out link.

   

6. Update Redirect URIs in Okta:

   1. In your Okta application, navigate to General -> Login.
   2. Under Sign-in redirect URIs, paste the copied Redirect link.
   3. In the same section, locate Sign-out redirect URIs and paste the Sign out link there.
   4. Click Save in Okta to finalize these configurations.

   

1. With the Okta OpenID configuration now established, proceed to the login screen.

2. Select the Federated authentication method, labeled with the Configuration name you specified.

   

3. Clicking on this authentication method will redirect you to the Okta page.

4. After filling your username and password of the Okta account, you will be automatically redirected and logged into the CloudBeaver.

Note: This feature is available in Enterprise, AWS, Team editions only.

CloudBeaver includes support for Kerberos authentication, enabling secure connections to your databases.

• AlloyDB for PostgreSQL
• CockroachDB
• Fujitsu Enterprise Postgres
• Greenplum
• SAP HANA
• MariaDB
• Oracle Database
• PostgreSQL
• MySQL
• Amazon Redshift
• Teradata
• TimescaleDB
• Trino (formerly PrestoSQL)
• Yellowbrick Data Warehouse

• YugabyteDB

Here are the steps to configure Kerberos authentication:

1) From the Authentication dropdown menu, select the Kerberos method. 2) Fill in the following fields:

> Tip: If you check the Save credentials for the current user option, you will not be asked to input your credentials every time you connect.

3) Once you have input your credentials, click the Test button to verify your settings. If everything is configured correctly, CloudBeaver should now be able to connect to your database using the Kerberos authentication method.

LDAP (Lightweight Directory Access Protocol) is a protocol designed to manage and access distributed directory information services over an Internet Protocol network. LDAP is used to store and retrieve data in a hierarchical directory structure, such as usernames and passwords, organizational units, and configuration settings. It facilitates directory management and authentication processes, allowing for a centralized approach to maintaining user credentials and policy settings.

For comprehensive guidance on configuring and managing LDAP, refer to the official LDAP documentation.

1. As an administrator, go to Settings -> Server Configuration.

2. Find and activate the LDAP option in the Configuration section.

   

3. Save the changes.

1. As an administrator, navigate to Settings -> Identity Providers.

2. Click on the + Add button.

3. Fill in the following fields:

   

   Field	Description	Parameters used to configure LDAP in the CloudBeaver Community
   Provider	Select LDAP from the dropdown menu.
   ID	Enter a unique identifier for the configuration.
   Configuration name	Enter a descriptive name for this configuration.
   Description	(Optional) Provide a brief description of this identity provider configuration.
   Icon URL	(Optional) Enter the URL of an icon to represent this provider.
   Disabled	(Optional) Leave unchecked to enable this identity provider.
   Host	Enter the server hostname or IP address where LDAP authentication is handled.	ldap-host : “”
   Port	Specify the port number used for LDAP communication.	ldap-port : “”
   User identifier attribute	Enter the attribute used to uniquely identify LDAP users. Default value in PRO versions is cn .	ldap-identifier-attr : “”
   Base Distinguished Name	(Optional) Enter the Base Distinguished Name (DN) for LDAP queries. It should be in the format appropriate for your LDAP directory, such as dc=example,dc=com . If not explicitly specified, this value will be automatically appended to the end of the User DN during authorization.	ldap-dn : “”
   Bind User DN	(Optional) Enter the Distinguished Name (DN) of the user who has permissions to search for entries (e.g., users) in the directory. This user will be used to verify access to the application with the specified filter.	ldap-bind-user : “”
   Bind User Password	(Optional) Enter the password associated with the Bind User DN account.	ldap-bind-user-pwd : “”
   User Filter	(Optional) Specify criteria for searching specific entries (users, groups, attributes). The filter must always be written in parentheses. Logical operators are supported.	ldap-filter : “()”

   Tip: You can specify organizational units within the Base Distinguished Name to streamline access, such as

   ou=unit1,dc=example,dc=com

   . These can be set during the Identity Provider setup or during login in CloudBeaver.

4. Click on the Create button.

1. With the LDAP configuration now established, proceed to the login screen.

2. Select the LDAP authentication method.

   

3. In the User DN field, enter the Distinguished Name (DN) of the user who is logging in. This specifies the exact entry within the LDAP directory associated with your user account.

4. Enter your User password in the corresponding field to authenticate.

   Note: If the Base Distinguished Name was specified during the setup of your LDAP configuration, it will be automatically appended to the User DN if not explicitly included. This can simplify the login process, especially when managing multiple users.

5. After entering the required information, click Login to access the application.

In CloudBeaver Community Edition, configuration settings are not accessible through the user interface (UI). Instead, settings must be configured directly within the workspace configuration file.

Steps to configure LDAP in Community Edition:

1. As an administrator, go to Settings -> Server Configuration and activate the LDAP option in the Configuration section.
2. Locate either the
   .cloudbeaver.runtime.conf
   file to configure LDAP for the current workspace or the
   .cloudbeaver.conf
   file to set the LDAP provider for all newly created workspaces. More details can be found in the server configuration guide.
3. Open the file with a text editor to modify or add LDAP configurations.
4. Insert the following configuration snippet into your configuration file under the
   app.authConfigurations
   section. Adjust the parameters according to your LDAP server details.

"authConfigurations": [

      {

        "id": "ldap",

        "provider": "ldap",

        "displayName": "LDAP",

        "disabled": false,

        "iconURL": "",

        "description": "",

        "parameters": {

          "ldap-host": "ldap.example.com",

          "ldap-port": "1389",

          "ldap-dn": "ou=users,dc=company,dc=com",

          "ldap-identifier-attr": "cn",

          "ldap-bind-user": "cn=serviceAccount1,ou=serviceAccounts,dc=company,dc=com",

          "ldap-bind-user-pwd": "serviceAccount1password",

          "ldap-filter": "(givenName=*)"

        }

      }

    ]

Important: Ensure that the

provider

is set to

ldap

.

5. After editing the configuration file, restart CloudBeaver for the changes to take effect.

6. Log in.

Note: This feature is available in Enterprise and Team editions only.

Local access authentication is a method for validating users based on usernames and passwords managed within the system.

1. As an administrator, navigate to the Settings -> Server configuration.

2. Locate the Local option and activate this setting to allow local authentication.

   

3. Save changes.

To grant local access, administrators set up individual user accounts. This involves creating each account with a unique username and a secure password in the Administration section. For detailed guidance on creating user accounts, refer to the Users article.

If an administrator disables all types of authentication, including Local, the administrator cannot log in with their credentials after logging out. In such a situation, you need to:

1. Open the file

   {cb_workspace}/.data/.cloudbeaver.runtime.conf
   .

2. Find

   enabledAuthProviders
   .

3. Add

   "local"
   to the list.

   
   "enabledAuthProviders": ["local"],
   
   

4. Restart the server to apply the changes.

CloudBeaver provides extensive customization and management capabilities through its Preferences settings, allowing both administrators and regular users to tailor the application according to their needs. To access these settings:

• Administrators: Navigate to Settings -> Administration -> Global Preferences.

• Users:

  • Go to Settings -> Preferences.
  • Alternatively, navigate to Profile -> Preferences

Upon accessing the preference page, you will encounter the following settings for customization:

Read more about SQL Editor.

The Log Viewer shows user logs during a session. It can be opened via the Tools menu on the main page of the application.

The Log Viewer contains the logs’ times and descriptions. If you want to see the full information about an error, click the error link. The error details will be displayed in a separate panel on the right.