Skip to main content

JDBC Key Pair Authentication

The Generic JDBC connector can authenticate with an RSA key pair (a private key plus an optional passphrase) instead of a username and password. Informer encrypts the key material at rest, the same way it encrypts passwords.

Why use key pair authentication​

Some databases support, or require, key pair authentication for service accounts. Snowflake, for example, can authenticate JDBC sessions with a signed token derived from an RSA private key rather than a reusable password, and supports rotating the key without changing the account.

The Generic JDBC connector forwards every entry in its Additional Properties to the underlying JDBC driver as a connection property. That means you configure key pair authentication entirely through those properties: there is no separate connector or special form to enable it.

How Informer stores key material​

Informer encrypts secret connection properties before they are saved. Alongside passwords, any Additional Property whose name refers to a private key or passphrase is encrypted at rest, for example private_key_base64, private_key_pwd, private_key_file_pwd, and passphrase. The plaintext value exists only in memory, at the moment a connection is opened; what Informer stores, and returns from the API, is the encrypted form.

note

Informer encrypts the key at rest, but the account it unlocks is only as safe as the key. Treat the private key like any other credential.

Connection properties​

A Snowflake key pair connection is configured with these pieces. The first two go in the main connection fields; the rest are Additional Properties.

FieldWhereValue
Connection StringConnection Stringjdbc:snowflake://<account>.snowflakecomputing.com/?warehouse=<wh>&db=<db>&schema=<schema>&role=<role>
Driver ClassDriver Classnet.snowflake.client.jdbc.SnowflakeDriver
userAdditional PropertiesThe Snowflake login name the public key is registered to
authenticatorAdditional Propertiessnowflake_jwt
private_key_base64 or private_key_fileAdditional PropertiesThe private key, supplied inline or by path (see below)
private_key_pwdAdditional PropertiesThe passphrase that decrypts the private key, only if the key is encrypted

Supplying the private key​

You can hand the driver the private key two ways:

  • Inline, private_key_base64: the base64 body of the .p8 key as a property value, so nothing is written to the server filesystem. Use this when you do not manage the Informer server's filesystem (for example, a hosted deployment). The value is the contents of the .p8 file with the -----BEGIN PRIVATE KEY----- and -----END PRIVATE KEY----- lines removed; the driver base64-decodes it to the key's DER bytes (do not include the header and footer lines). The walkthrough below produces it.
  • File path, private_key_file: the path to the .p8 private key file on the Informer server. Use forward slashes as path separators on every operating system. This requires the key to exist on a filesystem you control. Informer encrypts this value at rest along with the other key pair properties.
tip

Set private_key_pwd only when the private key is encrypted. Leave it unset for an unencrypted key. A missing or wrong passphrase reads to the driver as an invalid key.

Snowflake walkthrough​

  1. Generate an RSA key pair

    Follow Snowflake's key pair setup. A typical encrypted key in PKCS#8 format:

    # encrypted private key (prompts for a passphrase)
    openssl genrsa 2048 | openssl pkcs8 -topk8 -inform PEM -out rsa_key.p8

    # matching public key
    openssl rsa -in rsa_key.p8 -pubout -out rsa_key.pub

    For an unencrypted key, add -nocrypt to the pkcs8 command and skip the passphrase.

    For inline use (private_key_base64), take the .p8 body with the header and footer lines removed. This one-liner works for both encrypted and unencrypted keys:

    grep -v 'PRIVATE KEY' rsa_key.p8 | tr -d '\n'
  2. Register the public key on the Snowflake user

    Strip the header, footer, and line breaks from rsa_key.pub, then assign it to the user:

    ALTER USER my_service_user SET RSA_PUBLIC_KEY='MIIBIjANBgkq...';
  3. Create the Generic JDBC datasource

    Choose the Generic JDBC driver, then set the Connection String and Driver Class from the table above.

  4. Add the key pair properties

    In Additional Properties, add user, authenticator set to snowflake_jwt, and the private key (private_key_base64 from the previous step, or private_key_file). Add private_key_pwd only if the key is encrypted.

  5. Save and test

    Save the datasource. Informer encrypts the key material as it saves. See Connection Testing to confirm connectivity.

Troubleshooting​

  • Authentication fails / JWT token is invalid: the public key registered on the Snowflake user does not match the private key in the connection. Re-derive the public key from the same private key and re-run ALTER USER.
  • Private key provided is invalid or not supported: the key is not in PKCS#8 format, or the inline private_key_base64 value is not the encoding the driver expects. Regenerate with the pkcs8 command above, or switch to private_key_file.
  • Encrypted key, no passphrase: set private_key_pwd to the key's passphrase.
  • No suitable driver: set Driver Class to net.snowflake.client.jdbc.SnowflakeDriver so the connector registers the Snowflake driver before opening the connection.