CREATE CREDENTIAL - Kinetica Docs

Creates a new credential, which is a record that contains authentication information required to connect to a resource outside the database. Any user may create a credential for their own use.

CREATE CREDENTIAL Syntax

CREATE [OR REPLACE] CREDENTIAL [<schema name>.]<credential name>
TYPE = '<type>'
[, IDENTITY = '<username>']
[, SECRET = '<password>']
[WITH OPTIONS ('<option name>' = '<option value>'[,...])]

TYPE is case-insensitive.
Only the TYPE name is checked when the credential is created; whether it is appropriate is checked where the credential is used.
When a credential is used to authenticate a catalog, a SECRET given directly takes precedence over a token supplied in WITH OPTIONS.

For the syntax of each authentication scheme, see Provider-Specific Syntax below. For runnable examples of every one, see Creating Credentials in the Snippets section.

The following can make use of credentials:

The following services are supported:

Azure (Microsoft blob storage)
GCS (Google Cloud Storage)
HDFS (Apache Hadoop Distributed File System)
JDBC (Java Database Connectivity, using a user-supplied driver or one of the drivers on the supported list)
Kafka (streaming feed)
- Apache
- Confluent
Remote Repositories
- Docker
- Nvidia
- OpenAI
S3 (Amazon S3 Bucket)

Parameters

OR REPLACE

Any existing credential with the same name will be dropped before creating this one

Name of the schema that will contain the created credential; if no schema is specified, the credential will be created in the user’s default schema

Name of the credential to create; must adhere to the supported naming criteria

TYPE

The type of credential to create. Supported types include:

Type	Description
`aws_access_key`	Authenticate to Amazon Web Services (AWS) via Access Key
`aws_iam_role`	Authenticate to Amazon Web Services (AWS) via IAM Role
`azure_ad`	Authenticate to Microsoft Azure via Active Directory
`azure_oauth`	Authenticate to Microsoft Azure via OAuth
`azure_sas`	Authenticate to Microsoft Azure via Shared Access Signature (SAS) using an account-level access token, not a container-level one
`azure_storage_key`	Authenticate to Microsoft Azure via Storage Key
`confluent`	Authenticate to a Confluent Kafka cluster or schema registry
`docker`	Authenticate to a Docker repository
`gcs_service_account_id`	Authenticate to Google Cloud via user ID & private key
`gcs_service_account_keys`	Authenticate to Google Cloud via JSON key
`hdfs`	Authenticate to HDFS
`jdbc`	Authenticate via Java Database Connectivity
`kafka`	Authenticate to an Apache Kafka cluster or schema registry
`nvidia_api_key`	Authenticate to the Nvidia AI API
`openai_api_key`	Authenticate to the OpenAI API
`rest`	REST / OAuth bearer-token authentication for data lake catalog endpoints

IDENTITY

Optional username to use for authenticating with the credential. Its meaning depends on the credential TYPE; for rest, an IDENTITY & SECRET together form an OAuth client-credentials pair, while a SECRET alone is a bearer token.

SECRET

Optional password to use for authenticating with the credential.

WITH OPTIONS

Optional indicator that a comma-delimited list of option/value assignments will follow. See Options for the full list of options.

Examples

To create a credential, auser_azure_active_dir_creds, for connecting to Microsoft Azure Active Directory:

CREATE CREDENTIAL (Azure AD) Example

CREATE CREDENTIAL auser_azure_active_dir_creds
TYPE = 'azure_ad',
IDENTITY = 'atypicaluser',
SECRET = 'Passw0rd!'

To create a credential, kafka_cred, for connecting to Apache Kafka via SSL:

CREATE CREDENTIAL (Kafka SSL) Example

CREATE CREDENTIAL kafka_cred
TYPE = 'kafka'
WITH OPTIONS
(
    'security.protocol' = 'SSL',
    'ssl.ca.location' = 'kifs://ssl/ca-bundle.crt',
    'ssl.certificate.location' = 'kifs://ssl/client.pem',
    'ssl.key.location' = 'kifs://ssl/client.key',
    'ssl.key.password' = 'Passw0rd!'
)

Options

The following is a list of possible credential options and their associated providers. For valid combinations of credential options per provider and authentication mechanism, see Provider-Specific Syntax.

Option	Provider	Description
`azure_storage_account_name`	Azure	Azure storage account name (only used if `azure_tenant_id` is specified)
`azure_tenant_id`	Azure	Azure Active Directory tenant identifier
`gcs_service_account_keys`	GCS	Text of the JSON file containing the GCS private key
`hdfs_kerberos_keytab`	HDFS	Location of the Kerberos keytab file in KiFS
`hdfs_use_kerberos`	HDFS	Whether to attempt Kerberos authentication to HDFS
`s3_aws_role_arn`	S3	AWS S3 IAM role
`sasl.kerberos.keytab`	Kafka	Location of the Kerberos keytab file in KiFS
`sasl.kerberos.principal`	Kafka	Kerberos principal ID
`sasl.kerberos.service.name`	Kafka	Kerberos service name
`sasl.mechanism`	Kafka	SASL scheme to use; one of: * `PLAIN` * `GSSAPI`
`sasl.password`	Kafka	SASL user password
`sasl.username`	Kafka	SASL user ID
`security.protocol`	Kafka	Security protocol to use for authentication; one of: * `SSL` * `SASL_SSL` * `SASL_PLAINTEXT`
`ssl.ca.location`	Kafka	Location of CA certificates file in KiFS
`ssl.certificate.location`	Kafka	Location of client certificate in KiFS
`ssl.key.location`	Kafka	Location of client key in KiFS
`ssl.key.password`	Kafka	Password to client key or trust store

Provider-Specific Syntax

Several authentication schemes across multiple providers are supported.

Each form below links to a runnable example. For all of them in one place, see Creating Credentials in the Snippets section.

Azure

Syntax below, examples here.

CREATE CREDENTIAL [<schema name>.]<credential name>
TYPE = 'azure_storage_key',
IDENTITY = '<azure storage account name>',
SECRET = '<azure storage account key>'

CREATE CREDENTIAL [<schema name>.]<credential name>
TYPE = 'azure_sas',
IDENTITY = '<azure storage account name>',
SECRET = '<azure sas token>'

CREATE CREDENTIAL [<schema name>.]<credential name>
TYPE = 'azure_ad',
IDENTITY = '<ad client id>',
SECRET = '<ad client secret key>'
WITH OPTIONS
(
    STORAGE ACCOUNT NAME = '<azure storage account name>',
    TENANT ID = '<azure tenant id>'
)

CREATE CREDENTIAL [<schema name>.]<credential name>
TYPE = 'azure_oauth',
IDENTITY = '<azure storage account name>',
SECRET = '<azure oauth token>'

Data Lake Catalog

Syntax below, examples here. Used to authenticate data lake catalogs; a SECRET alone is a bearer token, while an IDENTITY & SECRET together form an OAuth client-credentials pair.

CREATE CREDENTIAL [<schema name>.]<credential name>
TYPE = 'rest',
SECRET = '<bearer token>'

CREATE CREDENTIAL [<schema name>.]<credential name>
TYPE = 'rest',
IDENTITY = '<oauth client id>',
SECRET = '<oauth client secret>'

GCS

Syntax below, examples here.

CREATE CREDENTIAL [<schema name>.]<credential name>
TYPE = 'gcs_service_account_id',
IDENTITY = '<gcs account id>',
SECRET = '<gcs account private key>'

CREATE CREDENTIAL [<schema name>.]<credential name>
TYPE = 'gcs_service_account_keys',
WITH OPTIONS (GCS_SERVICE_ACCOUNT_KEYS = '<gcs account json key text>')

HDFS

Syntax below, examples here.

CREATE CREDENTIAL [<schema name>.]<credential name>
TYPE = 'hdfs',
IDENTITY = '<hdfs username>',
SECRET = '<hdfs password>'

CREATE CREDENTIAL [<schema name>.]<credential name>
TYPE = 'hdfs',
IDENTITY = '<hdfs username>'
WITH OPTIONS (KERBEROS KEYTAB = 'kifs://<keytab file path>')

CREATE CREDENTIAL [<schema name>.]<credential name>
TYPE = 'hdfs',
IDENTITY = '<hdfs username>'
WITH OPTIONS (USE KERBEROS = 'true')

JDBC

Syntax below, examples here.

Password

CREATE CREDENTIAL [<schema name>.]<credential name>
TYPE = 'jdbc',
IDENTITY = '<username>',
SECRET = '<password>'

Kafka (Apache)

Syntax below, examples here.

CREATE CREDENTIAL [<schema name>.]<credential name>
TYPE = 'kafka'
WITH OPTIONS
(
    'security.protocol' = 'SSL',
    'ssl.ca.location' = 'kifs://<client ca certificates path>'
)

CREATE CREDENTIAL [<schema name>.]<credential name>
TYPE = 'kafka'
WITH OPTIONS
(
    'security.protocol' = 'SSL',
    'ssl.ca.location' = 'kifs://<client ca certificates path>',
    'ssl.certificate.location' = 'kifs://<client certificate path>'
)

CREATE CREDENTIAL [<schema name>.]<credential name>
TYPE = 'kafka'
WITH OPTIONS
(
    'security.protocol' = 'SSL',
    'ssl.ca.location' = 'kifs://<client ca certificates path>',
    'ssl.certificate.location' = 'kifs://<client certificate path>',
    'ssl.key.location' = 'kifs://<client key path>',
    'ssl.key.password' = '<client key password>'
)

CREATE CREDENTIAL [<schema name>.]<credential name>
TYPE = 'kafka'
WITH OPTIONS
(
    'security.protocol' = 'SASL_SSL',
    'sasl.mechanism' = 'PLAIN',
    'sasl.username' = '<sasl username>',
    'sasl.password' = '<sasl password>'
)

CREATE CREDENTIAL [<schema name>.]<credential name>
TYPE = 'kafka'
WITH OPTIONS
(
    'security.protocol' = 'SASL_PLAINTEXT',
    'sasl.mechanism' = 'GSSAPI',
    'sasl.kerberos.service.name' = '<kerberos service name>',
    'sasl.kerberos.keytab' = 'kifs://<kerberos keytab file>',
    'sasl.kerberos.principal' = '<kerberos principal>'
)

CREATE CREDENTIAL [<schema name>.]<credential name>
TYPE = 'kafka'
WITH OPTIONS
(
    'security.protocol' = 'SASL_SSL',
    'sasl.mechanism' = 'GSSAPI',
    'sasl.kerberos.service.name' = '<kerberos service name>',
    'sasl.kerberos.keytab' = 'kifs://<kerberos keytab file>',
    'sasl.kerberos.principal' = '<kerberos principal>',
    'ssl.ca.location' = 'kifs://<client ca certificates path>',
    'ssl.certificate.location' = 'kifs://<client certificate path>',
    'ssl.key.location' = 'kifs://<client key path>',
    'ssl.key.password' = '<client key password>'
)

Kafka (Confluent)

Syntax below, examples here.

CREATE CREDENTIAL [<schema name>.]<credential name>
TYPE = 'confluent'
WITH OPTIONS
(
    'security.protocol' = 'SSL',
    'ssl.ca.location' = 'kifs://<client ca certificates path>'
)

CREATE CREDENTIAL [<schema name>.]<credential name>
TYPE = 'confluent'
WITH OPTIONS
(
    'security.protocol' = 'SSL',
    'ssl.ca.location' = 'kifs://<client ca certificates path>',
    'ssl.certificate.location' = 'kifs://<client certificate path>'
)

CREATE CREDENTIAL [<schema name>.]<credential name>
TYPE = 'confluent'
WITH OPTIONS
(
    'security.protocol' = 'SSL',
    'ssl.ca.location' = 'kifs://<client ca certificates path>',
    'ssl.certificate.location' = 'kifs://<client certificate path>',
    'ssl.key.location' = 'kifs://<client key path>',
    'ssl.key.password' = '<client key password>'
)

CREATE CREDENTIAL [<schema name>.]<credential name>
TYPE = 'confluent'
WITH OPTIONS
(
    'security.protocol' = 'SASL_SSL',
    'sasl.mechanism' = 'PLAIN',
    'sasl.username' = '<sasl username>',
    'sasl.password' = '<sasl password>'
)

CREATE CREDENTIAL [<schema name>.]<credential name>
TYPE = 'confluent'
WITH OPTIONS
(
    'security.protocol' = 'SASL_PLAINTEXT',
    'sasl.mechanism' = 'GSSAPI',
    'sasl.kerberos.service.name' = '<kerberos service name>',
    'sasl.kerberos.keytab' = 'kifs://<kerberos keytab file>',
    'sasl.kerberos.principal' = '<kerberos principal>'
)

CREATE CREDENTIAL [<schema name>.]<credential name>
TYPE = 'confluent'
WITH OPTIONS
(
    'security.protocol' = 'SASL_SSL',
    'sasl.mechanism' = 'GSSAPI',
    'sasl.kerberos.service.name' = '<kerberos service name>',
    'sasl.kerberos.keytab' = 'kifs://<kerberos keytab file>',
    'sasl.kerberos.principal' = '<kerberos principal>',
    'ssl.ca.location' = 'kifs://<client ca certificates path>',
    'ssl.certificate.location' = 'kifs://<client certificate path>',
    'ssl.key.location' = 'kifs://<client key path>',
    'ssl.key.password' = '<client key password>'
)

Remote Repository

Syntax below, examples here.

CREATE CREDENTIAL [<schema name>.]<credential name>
TYPE = 'docker',
IDENTITY = '<username>',
SECRET = '<password>'

CREATE CREDENTIAL [<schema name>.]<credential name>
TYPE = 'nvidia_api_key',
SECRET = '<nvidia api key>'

CREATE CREDENTIAL [<schema name>.]<credential name>
TYPE = 'openai_api_key',
SECRET = '<openai api key>'

S3

Syntax below, examples here.

CREATE CREDENTIAL [<schema name>.]<credential name>
TYPE = 'aws_access_key',
IDENTITY = '<aws access key id>',
SECRET = '<aws secret access key>'

CREATE CREDENTIAL [<schema name>.]<credential name>
TYPE = 'aws_iam_role',
IDENTITY = '<aws access key id>',
SECRET = '<aws secret access key>'
WITH OPTIONS (S3_AWS_ROLE_ARN = '<amazon resource name>')

​Parameters

​Examples

​Options

​Provider-Specific Syntax

​Azure

​Data Lake Catalog

​GCS

​HDFS

​JDBC

​Kafka (Apache)

​Kafka (Confluent)

​Remote Repository

​S3

Parameters

Examples

Options

Provider-Specific Syntax

Azure

Data Lake Catalog

GCS

HDFS

JDBC

Kafka (Apache)

Kafka (Confluent)

Remote Repository

S3