Auth model reference

The auth-model field in a connection's configuration selects the authentication method. The keys you put in auth-properties depend on the selected model. For information on all available auth-properties IDs, see All auth models.

Note

auth-properties only appears in data-sources.json when you pre-configure credentials manually. After the first connection with save-password: true, DBeaver encrypts the credentials and removes auth-properties from the file. In a working connection you'll only see auth-model - the credentials are in the encrypted store.

How to configure authentication¶

Here is an example of a common auth model.

To set up username and password authentication, specify the ID that matches your database. Use native for most standard connections like PostgreSQL or MySQL. If you use a specific database, choose its dedicated ID from the list below.

Once you select the appropriate ID, add the following fields to your configuration:

Field	Description
`userName`	Database username
`userPassword`	Database password

Example

{
  "auth-model": "native",
  "auth-properties": {
    "userName": "postgres",
    "userPassword": "secret"
  }
}

All auth models¶

This table lists every auth model registered in DBeaver, with the auth-properties field names each one accepts.

Auth model ID	Name	auth-properties fields
`azure_ad_cosmos_nosql`	Microsoft Entra ID for Cosmos DB for NoSQL	`azureGroupName`, `useLegacyToken`
`azure_ad_mysql`	Microsoft Entra ID for MySQL	`azureGroupName`, `useLegacyToken`
`azure_ad_postgresql`	Microsoft Entra ID for PostgreSQL	`azureGroupName`, `useLegacyToken`
`azure_ad_sqlserver`	Microsoft Entra ID for SQL Server	-
`azure_ad_timescaledb`	Microsoft Entra ID for Timescale	`azureGroupName`, `useLegacyToken`
`cosmos-key`	Cosmos DB account key	`key`
`databricks_m2m`	OAuth (Machine to Machine)	`clientSecret`, `clientId`, `httpPath`
`databricks_oauth`	Databricks personal access token	`personalAccessToken`, `httpPath`
`databricks_sso`	Databricks OAuth (User to Machine) Web	`clientId`, `clientSecret`, `httpPath`
`databricks_u2m`	OAuth (User to Machine)	`httpPath`
`db2_entra_web`	DB2 Microsoft Entra ID (Web)	`tenantId`, `clientId`, `clientSecret`, `scope`, `sslCertificate`
`db2_entraid`	DB2 Microsoft Entra ID	`tenantId`, `clientId`, `clientSecret`, `scope`, `sslCertificate`
`db2_krb5`	DB2 Kerberos	`userName`, `userPassword`, `krbRealmName`, `cacheFilePath`, `krb5ConfPath`, `krbUserName`, `kdcServer`, `useKeytab`, `keytabPath`, `useKinit`
`documentdb_default`	DocumentDB authentication	`userName`, `userPassword`
`ferretdb_default`	FerretDB authentication	`userName`, `userPassword`, `sourceDatabase`, `mechanism`
`gcp_cloud_iam_alloydb`	Google Cloud IAM (AlloyDB)	`userName`, `userPassword`, `clientId`, `clientSecret`, `refreshToken`, `authType`, `serviceAccountConfig`
`gcp_cloud_iam_bigquery`	Google Cloud IAM (BigQuery)	`clientId`, `clientSecret`, `refreshToken`, `authType`, `serviceAccountConfig`
`gcp_cloud_iam_bigtable`	Google Cloud IAM (Bigtable)	`clientId`, `clientSecret`, `refreshToken`, `authType`, `serviceAccountConfig`
`gcp_cloud_iam_firestore`	Google Cloud IAM (Firestore)	`clientId`, `clientSecret`, `refreshToken`, `authType`, `serviceAccountConfig`
`gcp_cloud_iam_spanner`	Google Cloud IAM (Spanner)	`clientId`, `clientSecret`, `refreshToken`, `authType`, `serviceAccountConfig`
`gcp_sql_iam`	Google Cloud IAM	`userName`, `userPassword`, `clientId`, `clientSecret`, `refreshToken`, `authType`, `serviceAccountConfig`
`google_bigquery`	Google Cloud Auth	`userName`, `userPassword`
`google_spanner`	Google Cloud Auth	`userName`, `userPassword`
`iam`	AWS RDS IAM	`userName`, `region`, `awsAccessKey`, `awsSecretKey`, `awsSessionToken`, `awsAssumeAccountId`, `awsAssumeRoleName`, `awsExternalId`, `secretName`, `crossAccountAccess`, `defaultAwsCredentials`, `awsServerEndpoint`, `sessionCredentials`
`iam_athena`	AWS Athena IAM	`awsAccessKey`, `awsSecretKey`, `awsSessionToken`, `awsAssumeAccountId`, `awsAssumeRoleName`, `awsExternalId`, `secretName`, `crossAccountAccess`, `defaultAwsCredentials`, `awsServerEndpoint`, `sessionCredentials`
`iam_dsql`	Aurora DSQL Auth	`awsAccessKey`, `awsSecretKey`, `awsSessionToken`, `awsAssumeAccountId`, `awsAssumeRoleName`, `awsExternalId`, `secretName`, `crossAccountAccess`, `defaultAwsCredentials`, `awsServerEndpoint`, `sessionCredentials`
`iam_keyspaces`	AWS Keyspaces IAM	`userName`, `region`, `awsAccessKey`, `awsSecretKey`, `awsSessionToken`, `awsAssumeAccountId`, `awsAssumeRoleName`, `awsExternalId`, `secretName`, `crossAccountAccess`, `defaultAwsCredentials`, `awsServerEndpoint`, `sessionCredentials`
`iam_neptune`	AWS Neptune IAM	`region`, `awsAccessKey`, `awsSecretKey`, `awsSessionToken`, `awsAssumeAccountId`, `awsAssumeRoleName`, `awsExternalId`, `secretName`, `crossAccountAccess`, `defaultAwsCredentials`, `awsServerEndpoint`, `sessionCredentials`
`iam_simple`	AWS IAM	`awsAccessKey`, `awsSecretKey`, `awsSessionToken`, `awsAssumeAccountId`, `awsAssumeRoleName`, `awsExternalId`, `secretName`, `crossAccountAccess`, `defaultAwsCredentials`, `awsServerEndpoint`, `sessionCredentials`
`iam_timestream`	AWS Timestream IAM	`awsAccessKey`, `awsSecretKey`, `awsSessionToken`, `awsAssumeAccountId`, `awsAssumeRoleName`, `awsExternalId`, `secretName`, `crossAccountAccess`, `defaultAwsCredentials`, `awsServerEndpoint`, `sessionCredentials`
`influx2_token`	InfluxDB token	-
`krb5`	Kerberos	`userName`, `userPassword`, `krbRealmName`, `cacheFilePath`, `krb5ConfPath`, `krbUserName`, `kdcServer`, `useKeytab`, `keytabPath`, `useKinit`
`libsql_token_jdbc`	LibSQL Authentication	`userPassword`
`mongodb_default`	MongoDB authentication	`userName`, `userPassword`, `sourceDatabase`, `mechanism`
`mysql_krb5`	MySQL Kerberos	`userName`, `userPassword`, `krbRealmName`, `cacheFilePath`, `krb5ConfPath`, `krbUserName`, `kdcServer`, `useKeytab`, `keytabPath`, `useKinit`
`native`	Username/password	`userName`, `userPassword`
`oceanbase_native`	Oceanbase Native	`userName`, `userPassword`
`oracle_entraid`	Oracle Microsoft Entra ID	`tenantId`, `clientId`, `clientSecret`, `scope`, `walletArchive`
`oracle_krb5`	Oracle Kerberos	`userName`, `userPassword`, `krbRealmName`, `cacheFilePath`, `krb5ConfPath`, `krbUserName`, `kdcServer`, `useKeytab`, `keytabPath`, `useKinit`
`oracle_native`	Username/password	`userName`, `userPassword`
`oracle_os`	Oracle OS authentication	-
`oracle_wallet`	Oracle Wallet	`userName`, `userPassword`, `walletArchive`
`postgres_pgpass`	PostgreSQL PgPass	`userName`
`postgres_sspi`	PostgreSQL SSPI (Windows SSO)	`userName`, `userPassword`
`postgresql_krb5`	PostgreSQL Kerberos	`userName`, `userPassword`, `krbRealmName`, `cacheFilePath`, `krb5ConfPath`, `krbUserName`, `kdcServer`, `useKeytab`, `keytabPath`, `useKinit`
`prestodb_krb5`	PrestoDB Kerberos	`userName`, `userPassword`, `krbRealmName`, `cacheFilePath`, `krb5ConfPath`, `krbUserName`, `kdcServer`, `useKeytab`, `keytabPath`, `useKinit`
`prestosql_krb5`	PrestoSQL Kerberos	`userName`, `userPassword`, `krbRealmName`, `cacheFilePath`, `krb5ConfPath`, `krbUserName`, `kdcServer`, `useKeytab`, `keytabPath`, `useKinit`
`profile`	DBeaver profile	`profile`
`redis_password`	Sentinel Authentication	`userName`, `userPassword`, `nodePassword`
`redshift_iam`	AWS Redshift IAM	`userName`, `region`, `awsAccessKey`, `awsSecretKey`, `awsSessionToken`, `awsAssumeAccountId`, `awsAssumeRoleName`, `awsExternalId`, `secretName`, `crossAccountAccess`, `defaultAwsCredentials`, `awsServerEndpoint`, `sessionCredentials`
`salesforce`	Salesforce password authentication	`userName`, `userPassword`, `authToken`
`salesforce_cdp_oauth`	Salesforce authentication	`userName`, `userPassword`, `clientId`, `clientSecret`
`salesforce_oauth`	Salesforce OAuth authentication	`clientSecret`, `clientID`
`snowflake_externalbrowser`	Snowflake SSO (Browser)	`userName`, `userPassword`, `role`
`snowflake_key`	Snowflake private key	`userName`, `encodedPrivateKey`, `passphrase`, `role`
`snowflake_oauth`	Snowflake OAuth	`clientId`, `clientSecret`, `authUrl`, `tokenUrl`, `scope`
`snowflake_pro`	Snowflake username/password	`userName`, `userPassword`, `role`
`snowflake_snowflake`	Snowflake username/password	`userName`, `userPassword`, `role`
`sqlserver_ad_integrated`	Active Directory - Integrated	`userName`, `userPassword`
`sqlserver_ad_password`	SQL Server Active Directory - Password	`userName`, `userPassword`
`sqlserver_custom`	SQL Server custom Authentication	`userName`, `userPassword`
`sqlserver_database`	SQL Server Authentication	`userName`, `userPassword`
`sqlserver_kerberos`	SQL Server Kerberos Authentication	`userName`, `userPassword`, `krbRealmName`, `cacheFilePath`, `krb5ConfPath`, `krbUserName`, `kdcServer`, `useKeytab`, `keytabPath`, `useKinit`
`sqlserver_mfa`	Active Directory - MFA	`userName`, `userPassword`
`sqlserver_msi`	Active Directory - MSI	`userName`
`sqlserver_ntlm`	SQL Server NTLM	`userName`, `userPassword`
`sqlserver_windows`	Windows Authentication	`userName`, `userPassword`
`teradata_LDAP`	LDAP Mechanism	`userName`, `userPassword`
`teradata_SSO`	Teradata single sign-on	`userName`, `userPassword`
`teradata_krb5`	Teradata Kerberos Authentication	`userName`, `userPassword`, `krbRealmName`, `cacheFilePath`, `krb5ConfPath`, `krbUserName`, `kdcServer`, `useKeytab`, `keytabPath`, `useKinit`
`tfa`	Two-factor authentication	`userName`, `userPassword`
`trino_krb5`	Trino Kerberos	`userName`, `userPassword`, `krbRealmName`, `cacheFilePath`, `krb5ConfPath`, `krbUserName`, `kdcServer`, `useKeytab`, `keytabPath`, `useKinit`
`yellowbrick_oauth2`	Yellowbrick OAuth2	`clientSecret`, `issuer`, `clientID`