Credentials - Kinetica Docs

A credential is an authentication object for a resource or repository that is external to the database. It consists of the credentials used to authenticate to that external system, with the goal of providing an authentication token to any database object that may need to connect to that system. A credential name must adhere to the standard naming criteria. Each credential exists within a schema and follows the standard name resolution rules for tables. The following can make use of credentials:

Data sources (see also the CREATE DATA SOURCE command in SQL)
Data sinks (see also the CREATE DATA SINK command in SQL)
ML container registries (see also the CREATE CONTAINER REGISTRY command in SQL)

Any user can create a credential for their own use. The following services are supported:

Azure
Google Cloud
HDFS
JDBC
Kafka
- Apache Cluster
- Confluent Cluster
Remote Repositories
- Docker
- Nvidia
- OpenAI
S3

Managing Credentials

A credential can be managed using the following API endpoint calls. For managing credentials in SQL, see CREATE CREDENTIAL.

API Call	Description
/create/credential	Creates a credential, given authentication and connection information
/alter/credential	Modifies the properties of a credential
/drop/credential	Removes the credential reference from the database
/show/credential	Outputs the credential’s properties
/grant/permission/credential	Grants the permission for a user to use or manage a credential or all credentials
/revoke/permission/credential	Revokes the permission for a user to use or manage a credential or all credentials

Creating a Credential

To create a credential, auser_azure_active_dir_creds, that connects to Azure Active Directory:

CREATE CREDENTIAL auser_azure_active_dir_creds
TYPE = 'azure_ad',
IDENTITY = 'atypicaluser',
SECRET = 'Passw0rd!'

kinetica.create_credential(
    credential_name = 'auser_azure_active_dir_creds',
    type = 'azure_ad',
    identity = uid,
    secret = pwd
)

To create a credential, kafka_cred, that connects to Kafka via SSL:

CREATE CREDENTIAL kafka_cred
TYPE = 'kafka'
WITH OPTIONS
(
    'security.protocol' = 'SSL',
    'ssl.ca.location' = 'kifs://ssl/ca-bundle.crt',
    'ssl.certificate.location' = 'kifs://ssl/client.pem',
    'ssl.key.location' = 'kifs://ssl/client.key',
    'ssl.key.password' = 'Passw0rd!'
)

kinetica.create_credential(
    credential_name = 'kafka_cred',
    type = 'kafka',
    identity = '',
    secret = '',
    options = {
        'security.protocol': 'SSL',
        'ssl.ca.location': 'kifs://ssl/ca-bundle.crt',
        'ssl.certificate.location': 'kifs://ssl/client.pem',
        'ssl.key.location': 'kifs://ssl/client.key',
        'ssl.key.password': 'Passw0rd!'
    }
)

Provider-Specific Syntax

Several authentication schemes across multiple providers are supported.

Azure BLOB

kinetica.create_credential(
    credential_name = '[<schema name>.]<credential name>',
    type = 'azure_storage_key',
    identity = '<azure storage account name>',
    secret = '<azure storage account key>',
    options = {}
)

kinetica.create_credential(
    credential_name = '[<schema name>.]<credential name>',
    type = 'azure_sas',
    identity = '<azure storage account name>',
    secret = '<azure sas token>',
    options = {}
)

kinetica.create_credential(
    credential_name = '[<schema name>.]<credential name>',
    type = 'azure_ad',
    identity = '<ad client id>',
    secret = '<ad client secret key>',
    options = {
        'azure_storage_account_name': '<azure storage account name>',
        'azure_tenant_id': '<azure tenant id>'
    }
)

GCS

kinetica.create_credential(
    credential_name = '[<schema name>.]<credential name>',
    type = 'gcs_service_account_id',
    identity = '<gcs account id>',
    secret = '<gcs account private key>',
    options = {}
)

kinetica.create_credential(
    credential_name = '[<schema name>.]<credential name>',
    type = 'gcs_service_account_keys',
    identity = '',
    secret = '',
    options = {
        'gcs_service_account_keys': '<gcs account json key text>'
    }
)

HDFS

kinetica.create_credential(
    credential_name = '[<schema name>.]<credential name>',
    type = 'hdfs',
    identity = '<hdfs username>',
    secret = '<hdfs password>',
    options = {}
)

kinetica.create_credential(
    credential_name = '[<schema name>.]<credential name>',
    type = 'hdfs',
    identity = '<hdfs username>',
    options = {
        'hdfs_kerberos_keytab': 'kifs://<keytab file path>'
    }
)

kinetica.create_credential(
    credential_name = '[<schema name>.]<credential name>',
    type = 'hdfs',
    identity = '<hdfs username>',
    secret = '',
    options = {
        'hdfs_use_kerberos': 'true'
    }
)

JDBC

Password

kinetica.create_credential(
    credential_name = '[<schema name>.]<credential name>',
    type = 'jdbc',
    identity = '<jdbc username>',
    secret = '<jdbc password>',
    options = {}
)

Kafka (Apache)

kinetica.create_credential(
    credential_name = '[<schema name>.]<credential name>',
    type = 'kafka',
    identity = '',
    secret = '',
    options = {
        'security.protocol': 'SSL',
        'ssl.ca.location': 'kifs://<client ca certificates path>'
    }
)

kinetica.create_credential(
    credential_name = '[<schema name>.]<credential name>',
    type = 'kafka',
    identity = '',
    secret = '',
    options = {
        'security.protocol': 'SSL',
        'ssl.ca.location': 'kifs://<client ca certificates path>',
        'ssl.certificate.location': 'kifs://<client certificate path>'
    }
)

kinetica.create_credential(
    credential_name = '[<schema name>.]<credential name>',
    type = 'kafka',
    identity = '',
    secret = '',
    options = {
        'security.protocol': 'SSL',
        'ssl.ca.location': 'kifs://<client ca certificates path>',
        'ssl.certificate.location': 'kifs://<client certificate path>',
        'ssl.key.location': 'kifs://<client key path>',
        'ssl.key.password': '<client key password>'
    }
)

kinetica.create_credential(
    credential_name = '[<schema name>.]<credential name>',
    type = 'kafka',
    identity = '',
    secret = '',
    options = {
        'security.protocol': 'SASL_SSL',
        'sasl.mechanism': 'PLAIN',
        'sasl.username': '<sasl username>',
        'sasl.password': '<sasl password>'
    }
)

kinetica.create_credential(
    credential_name = '[<schema name>.]<credential name>',
    type = 'kafka',
    identity = '',
    secret = '',
    options = {
        'security.protocol': 'SASL_PLAINTEXT',
        'sasl.mechanism': 'GSSAPI',
        'sasl.kerberos.service.name': '<kerberos service name>',
        'sasl.kerberos.keytab': 'kifs://<kerberos keytab file>',
        'sasl.kerberos.principal': '<kerberos principal>'
    }
)

kinetica.create_credential(
    credential_name = '[<schema name>.]<credential name>',
    type = 'kafka',
    identity = '',
    secret = '',
    options = {
        'security.protocol': 'SASL_SSL',
        'sasl.mechanism': 'GSSAPI',
        'sasl.kerberos.service.name': '<kerberos service name>',
        'sasl.kerberos.keytab': 'kifs://<kerberos keytab file>',
        'sasl.kerberos.principal': '<kerberos principal>',
        'ssl.ca.location': 'kifs://<client ca certificates path>',
        'ssl.certificate.location': 'kifs://<client certificate path>',
        'ssl.key.location': 'kifs://<client key path>',
        'ssl.key.password': '<client key password>'
    }
)

Kafka (Confluent)

kinetica.create_credential(
    credential_name = '[<schema name>.]<credential name>',
    type = 'confluent',
    identity = '',
    secret = '',
    options = {
        'security.protocol': 'SSL',
        'ssl.ca.location': 'kifs://<client ca certificates path>'
    }
)

kinetica.create_credential(
    credential_name = '[<schema name>.]<credential name>',
    type = 'confluent',
    identity = '',
    secret = '',
    options = {
        'security.protocol': 'SSL',
        'ssl.ca.location': 'kifs://<client ca certificates path>',
        'ssl.certificate.location': 'kifs://<client certificate path>'
    }
)

kinetica.create_credential(
    credential_name = '[<schema name>.]<credential name>',
    type = 'confluent',
    identity = '',
    secret = '',
    options = {
        'security.protocol': 'SSL',
        'ssl.ca.location': 'kifs://<client ca certificates path>',
        'ssl.certificate.location': 'kifs://<client certificate path>',
        'ssl.key.location': 'kifs://<client key path>',
        'ssl.key.password': '<client key password>'
    }
)

kinetica.create_credential(
    credential_name = '[<schema name>.]<credential name>',
    type = 'confluent',
    identity = '',
    secret = '',
    options = {
        'security.protocol': 'SASL_SSL',
        'sasl.mechanism': 'PLAIN',
        'sasl.username': '<sasl username>',
        'sasl.password': '<sasl password>'
    }
)

kinetica.create_credential(
    credential_name = '[<schema name>.]<credential name>',
    type = 'confluent',
    identity = '',
    secret = '',
    options = {
        'security.protocol': 'SASL_PLAINTEXT',
        'sasl.mechanism': 'GSSAPI',
        'sasl.kerberos.service.name': '<kerberos service name>',
        'sasl.kerberos.keytab': 'kifs://<kerberos keytab file>',
        'sasl.kerberos.principal': '<kerberos principal>'
    }
)

kinetica.create_credential(
    credential_name = '[<schema name>.]<credential name>',
    type = 'confluent',
    identity = '',
    secret = '',
    options = {
        'security.protocol': 'SASL_SSL',
        'sasl.mechanism': 'GSSAPI',
        'sasl.kerberos.service.name': '<kerberos service name>',
        'sasl.kerberos.keytab': 'kifs://<kerberos keytab file>',
        'sasl.kerberos.principal': '<kerberos principal>',
        'ssl.ca.location': 'kifs://<client ca certificates path>',
        'ssl.certificate.location': 'kifs://<client certificate path>',
        'ssl.key.location': 'kifs://<client key path>',
        'ssl.key.password': '<client key password>'
    }
)

Remote Repository

kinetica.create_credential(
    credential_name = '[<schema name>.]<credential name>',
    type = 'docker',
    identity = '<docker username>',
    secret = '<docker password>'
)

kinetica.create_credential(
    credential_name = '[<schema name>.]<credential name>',
    type = 'nvidia_api_key',
    identity = '',
    secret = '<nvidia api key>'
)

kinetica.create_credential(
    credential_name = '[<schema name>.]<credential name>',
    type = 'openai_api_key',
    identity = '',
    secret = '<openai api key>'
)

S3 (Amazon)

kinetica.create_credential(
    credential_name = '[<schema name>.]<credential name>',
    type = 'aws_access_key',
    identity = '<aws access key id>',
    secret = '<aws secret access key>'
)

kinetica.create_credential(
    credential_name = '[<schema name>.]<credential name>',
    type = 'aws_iam_role',
    identity = '<aws access key id>',
    secret = '<aws secret access key>',
    options = {
        's3_aws_role_arn': '<amazon resource name>'
    }
)

Altering a Credential

To alter an existing credential, auser_azure_active_dir_creds, for a new secret:

ALTER CREDENTIAL auser_azure_active_dir_creds
SET PROPERTY
    SECRET = 'atypicaluserNewPassw0rd!'

kinetica.alter_credential(
    credential_name = 'auser_azure_active_dir_creds',
    credential_updates_map = {
      'secret': new_pwd
    },
    options = {}
)

Removing a Credential

To remove an existing credential, auser_azure_active_dir_creds:

DROP CREDENTIAL auser_azure_active_dir_creds

kinetica.drop_credential('auser_azure_active_dir_creds')

Showing a Credential

To show the configuration for an existing credential, auser_azure_active_dir_creds, while masking the secret:

SHOW CREDENTIAL auser_azure_active_dir_creds

kinetica_read = gpudb.GPUdb(host = [args.url], username = 'auser', password = 'password')

response = kinetica_read.show_credential('auser_azure_active_dir_creds')

The output for the above:

{
    "credential_names": [
        "ki_home.auser_azure_active_dir_creds"
    ],
    "credential_types": [
        "azure_ad"
    ],
    "credential_identities": [
        ""
    ],
    "credentials": [
        "{\"credential_name\":\"ki_home.auser_azure_active_dir_creds\",\"type\":\"azure_ad\",\"identity\":\"\",\"secret\":\"\",\"options\":{}}"
    ],
    "additional_info": [
        {}
    ],
    "info": {},
    "status_info": {
        "status": "OK",
        "message": "",
        "data_type": "show_credential_response",
        "response_time": <fast>
    }
}

Updating Credential Permissions

To grant credential_read permission to a user, auser:

GRANT READ ON CREDENTIAL auser_azure_active_dir_creds TO auser

kinetica.grant_permission_credential(
    name = 'auser',
    permission = 'credential_read',
    credential_name = 'auser_azure_active_dir_creds'
)

To revoke credential_read permission from a user, auser:

REVOKE READ ON CREDENTIAL auser_azure_active_dir_creds FROM auser

kinetica.revoke_permission_credential(
    name = 'auser',
    permission = 'credential_read',
    credential_name = 'auser_azure_active_dir_creds'
)

​Managing Credentials

​Creating a Credential

​Provider-Specific Syntax

​Azure BLOB

​GCS

​HDFS

​JDBC

​Kafka (Apache)

​Kafka (Confluent)

​Remote Repository

​S3 (Amazon)

​Altering a Credential

​Removing a Credential

​Showing a Credential

​Updating Credential Permissions