User credentials and supported authentication methods

Data Virtualization uses your IBM® Cloud credentials to connect to the service.

Authorization

Cloud Pak for Data users who are authorized can connect to and use Data Virtualization.

Data Virtualization roles are used for authorization, independently of group membership. Data Virtualization uses role-based access control for database-level and object-level authorization.

Data Virtualization follows authorization based on the Db2® Authorities and Privilege model.

Authentication

If you authenticate to Data Virtualization directly by using JDBC client applications or when prompted in different scenarios, such as, when previewing assets in the catalog, project, etc., you must specify the API key or auth token.

A Data Virtualization Manager must explicitly add Cloud Pak for Data users to the Data Virtualization service in order for these users to authenticate to the service directly. When the Data Virtualization Manager adds a Cloud Pak for Data user to the service, a Data Virtualization role is assigned to the user.

Data Virtualization supports the following authentication methods:

User ID considerations

When you add a user in Data Virtualization as a service, the Add IBMid user page prompts for a valid IBMid. This ID is the IBM Cloud ID. The Data Virtualization as a service User ID is created automatically as dv_<ibm_id>.

JWT tokens

You can connect with JSON Web Tokens (JWT).

JDBC access token
"jdbc:db2://Host_name_or_IP_address/Database_name:accessToken=Access_token;securityMechanism=15;pluginName=IBMIAMauth;sslConnection=true"

Where Access_token is the Cloud Pak for Data platform or instance token.

CLP access token
Connect to the database server Database_server_name and pass the access token by running the following command at the CLP command prompt or from a script:
CONNECT TO Database_server_name ACCESSTOKEN Access_token
CLPPlus access token
Connect to the DSN alias (@Data_source_name) and pass the access token by running the following command at the CLPPLUS command prompt or from a script:
CONNECT @Data_source_name using(accesstoken Access_token)

API keys

You can connect by providing an API key.

JDBC API key
"jdbc:db2://Host_name_or_IP_address:DV_SSL_port/Database_name:apiKey=API_key;securityMechanism=15;pluginName=IBMIAMauth;sslConnection=true"
Where API_key is the Cloud Pak for Data platform or instance API key.
CLP API key
Connect to the database server Database_server_name with an API key by running the following command at the CLP command prompt or from a script:
CONNECT TO Database_server_name APIKEY API_key
CLPPlus API key
Connect to the DSN alias (@data_source_name) with an API key by running the following command at the CLPPLUS command prompt or from a script:
CONNECT @Data_source_name using(apikey API_key)