Connect to a database through privileged access

Database connections through privileged access are in development. When they are available, you will connect to a database with your usual client, without ever seeing the database password. This article explains the steps in advance.

What do I need?

• An approved and active access to the database account. See Request privileged access.
• A client that supports TLS: psql, DBeaver, DataGrip or another PostgreSQL client.

How do I connect with psql?

1. Under «Access» › «My access», in «Active leases», ask for a database connection on your access.
2. The console shows the host, the port (6432), the user (your access handle, which starts with l-) and a single-use password, valid for one minute.
3. Run the command the console shows, which has this form:

psql "host=<gateway> port=6432 dbname=<database> user=<access handle> sslmode=verify-full"

4. When psql asks for the password, paste the single-use password. You are connected.

If the minute passes before you connect, ask for a new password: each one works once.

And with a graphical client?

Create a connection with the same host, port, user and database, set SSL to "verify-full" (or the client's equivalent, which checks the server's certificate) and paste the single-use password when it is asked for. Do not save the password in the client: it will not work again.

What is recorded?

Every statement you run, with its duration, its result and any error, is recorded. The rows returned are never recorded, and the values you pass as parameters are masked unless your organization decided otherwise. Do not type personal passwords or data you do not need into your statements.

What can end the connection?

• The end of the access period you requested.
• A rule of your organization that ends the session or blocks a statement.
• An administrator ending the session.

In each case your client shows the reason. Cancelling a running query (Ctrl+C in psql) works as usual.

When should I contact support?

If the connection is refused although your access is active, note the time and the message and contact your administrator. Never send them the single-use password.