Databases

The Bridge can broker access to MySQL, PostgreSQL, CockroachDB, SQL Server (MSSQL), Redis, MongoDB, Cassandra, and Oracle beta. In every case the user reaches the database through a brokered, recorded session and never holds the real database credentials.

MongoDB native access requires bridge_auth_password for its SCRAM exchange. Browser-only MongoDB checkouts can omit it. All native database clients authenticate before Bridge uses the target credentials.

Each database can be offered two ways, and you can use either or both:

• Native mode - users point their normal database tool at a port on the Bridge. That can be a command-line client (mysql, psql, redis-cli, mongosh, and so on) or a graphical tool (DBeaver, TablePlus, MySQL Workbench, etc.). To the tool it looks like an ordinary database connection; the Bridge stands in the middle.
• Browser mode - users run queries in a built-in query window inside the Bridge web interface, with nothing to install.

Jump to an engine: MySQL · PostgreSQL · CockroachDB · SQL Server · Redis · MongoDB · Cassandra · Oracle beta

The in-browser SQL client (auto-enabled)

There is no separate switch for the in-browser query window. It turns on automatically as soon as any database protocol has browser mode enabled. For example, enabling browser mode for PostgreSQL alone makes the in-browser SQL client available for it; adding MySQL browser mode extends the same client to MySQL too.

postgres:
  browser:
    enabled: true   # this alone activates the in-browser SQL client

How native mode works

Pick a port for the Bridge to listen on, then have users point their client at the Bridge instead of the real database. The default ports below match each database’s conventional port, so existing tools usually need only the address changed.

# MySQL example - connect the normal client to the Bridge
mysql -h bridge.example.com -P 3306 -u 'alice%mysql-primary.internal' -p

For native database clients, Bridge routes the session from the database username. Use <bridge-user>%<target-host> as the username so Bridge can match the checkout and connect to the approved target.

Who authenticates, and to what

Every native client proves the checkout owner’s password before Bridge connects with vaulted target credentials. Use native_auth: ldap for directory validation or native_auth: bridge_credentials for a separate bridge_auth_password. MongoDB and Oracle native access require Bridge credentials.

ldap_auth_passthrough controls which credentials Bridge forwards to a supported target. It does not enable or disable client authentication. Native PostgreSQL, CockroachDB and MSSQL target connections require TLS. Browser database targets require TLS except protocols with their own documented encryption configuration. Configure trusted target certificates before upgrading.

Each database

MySQL

mysql:
  idle_timeout: 30m
  native:
    enabled: true
    listen: "3306"
  browser:
    enabled: true

PostgreSQL

postgres:
  idle_timeout: 30m
  native:
    enabled: true
    listen: "5432"
  browser:
    enabled: true

Native PostgreSQL checkouts may set ldap_auth_passthrough to sign in as the connecting user rather than a stored account. The target must accept a password: ldap in pg_hba.conf is the point of it, and password or md5 also work. scram-sha-256 is not supported for the backend login.

CockroachDB

CockroachDB speaks the PostgreSQL wire protocol but has its own conventional port.

cockroachdb:
  idle_timeout: 30m
  native:
    enabled: true
    listen: "26257"
  browser:
    enabled: true

SQL Server (MSSQL)

mssql:
  idle_timeout: 30m
  native:
    enabled: true
    listen: "1433"
  browser:
    enabled: true

Native SQL Server checkouts may set ldap_auth_passthrough to sign in with Windows Authentication as the connecting user, which suits targets that grant access by AD group and store no SQL login. Bridge verifies the user’s directory password and then uses it to compute the logon response, so the password itself is never sent to the target. Set target_domain, or put the domain in target_username as DOMAIN\user.

Redis

redis:
  idle_timeout: 30m
  native:
    enabled: true
    listen: "6379"
  browser:
    enabled: true

MongoDB

mongodb:
  idle_timeout: 30m
  native:
    enabled: true
    listen: "27017"
  browser:
    enabled: true

Cassandra

cassandra:
  idle_timeout: 30m
  native:
    enabled: true
    listen: "9042"
  browser:
    enabled: true

Oracle beta

Oracle is an opt-in beta for development and testing, disabled by default and not production-ready.

oracle:
  idle_timeout: 30m
  native:
    enabled: true
    listen: "1521"
    require_tls: true
  browser:
    enabled: true

Oracle checkouts require vaulted target_username and target_password, plus target_database for the service name. Use oracle_connect_type: sid for a SID.

Native access requires an Oracle fast-authentication client, native_auth: bridge_credentials, and a separate bridge_auth_password. Clients must trust the Bridge certificate. LDAP native authentication is not supported.

For verified target TLS, set target_tls: true, use the target’s TCPS port, and supply target_ca_cert for a private CA. See the database checkout examples.

Mixing modes

You can enable native for some databases and browser for others, or both for the same database. This example offers PostgreSQL through users’ own tools, MySQL through the browser, and Redis through both.

postgres:
  native:
    enabled: true
    listen: "5432"

mysql:
  browser:
    enabled: true

redis:
  native:
    enabled: true
    listen: "6379"
  browser:
    enabled: true

Option reference

Each database protocol exposes the same three-part structure. The default native port differs per database.

Native client TLS

PostgreSQL, CockroachDB, MSSQL, Redis and Cassandra clients require TLS. RESTCONF and WinRM use HTTPS. MySQL directory login requires TLS and caching_sha2_password negotiation; Bridge-password login supports the reviewed challenge-response plugins. Oracle native clients require TLS by default. Configure the client to trust Bridge’s certificate and retain hostname verification. Target TLS is a separate connection.