Arrow Flight SQL Security Guidelines | Teradata Fabric - Arrow Flight SQL Connector Security Guidelines - Teradata Fabric

Teradata® Fabric - Installation and User Guide - 3.11
Product
Teradata Fabric
Release Number
3.11
Publication Date
August 2026
Content Type
Administration
Configuration
Installation
User Guide
Publication ID
B035-5991-086K
ft:locale
en-US
ft:lastEdition
2026-08-15
dita:mapPath
svw1780362788070.ditamap
dita:ditavalPath
ezw1784752870623.ditaval
ft:sourceId
dita
dita:id
lxg1591800469257
Arrow Flight SQL connectors support authentication for database (DB Password), OAuth 2.0, personal access tokens (PAT), OIDC SSO, TLS, and Dremio Sonar Projects when acting as target connectors. The following consideration applies to the security mechanisms:
  • The username and password assigned and communicated from the initiator connector takes precedence over the one defined for the Arrow Flight SQL target connector properties.

    For example, if the Teradata initiator provides an authorization object, the Teradata initiator settings take precedence over security-related Arrow Flight SQL connector property settings. Defining these connector properties is optional. However, if credentials are not provided by the initiator connector, a username and password must exist in the connector property settings.

Database
Arrow Flight SQL stores encrypted credential information and user passwords in the data dictionary to authenticate users attempting to connect to the database.
The Teradata connector username takes precedence over the username and password set in the Arrow Flight SQL connector properties.
Setting Description
Username [Optional] Set to the authorized user name.
Password [Optional] Set the password for the authorized user.
OAuth 2.0
If the target database supports OAuth 2.0, choose this authentication method. The target database must be integrated with an identity provider (IdP).
Setting Description
Client Secret Used by confidential clients to request OAuth 2.0 access tokens from the IdP.

For Dremio, the client secret is optional for the token exchange.
Token Request URL IdP OAuth 2.0 token endpoint URL.
Token Request Additional Payload Information Use the additional payload fields to include the IdP OAuth 2.0 token requests, such as client_id, grant_type, and scope. Use the required format:

grant_type=password;client_id=client id value;scppe=profile openid

If grant_type is password, the username and password are required for the IdP OAuth 2.0 token request.
Username [Optional] Set to the authorized IdP user name for the OAuth 2.0 token request when grant_type is password.
Password [Optional] Set the password for the authorized IdP user for the OAuth 2.0 token request.
Token Exchange URL [Optional] Set the HTTPS endpoint as the IdP where the client submits a token-exchange request to obtain a new access token with a different audience or scope.

For Dremio, use Dremio's OAuth 2.0 token-exchange endpoint (not the IdP's endpoint).
Token Exchange Additional Payload Information [Optional] Use the additional payload fields to include the IdP OAuth 2.0 token requests, such as client_id, grant_type, scope, and audience. Use the required format:

grant_type=urn:ietf:params:oauth:grant-type:token-exchange;client_id=client id value;scppe=scope value;subject_token_type=urn:ietf:params:oauth:token-type:jwt
Personal Access Token (PAT)

A Personal Access Token (PAT) is a user-generated credential used to authenticate target databases. Instead of a password, a PAT can be used for authentication. The Arrow Flight SQL connector uses the PAT to perform a token exchange to obtain a short-lived access token that is used to connect to the target database.

Only supported with Dremio.
Setting Description
Personal Access Token Add your PAT credentials. The PAT is redacted from Viewpoint and system logs.

For more information, see .Arrow Flight SQL Connector and Link Properties

OIDC SSO
If the target database supports OpenID Connect (OIDC), choose this authentication method. Single sign-on (SSO) must be initiated from the Teradata database. Both the Teradata database and the target Arrow Flight SQL-compliant database must be integrated with the same IdP.
Setting Description
Client Secret Used by confidential clients to perform token exchanges with the IdP.

For Dremio, the client secret is optional for the token exchange.
Token Exchange URL Set the HTTPS endpoint as the IdP where the client submits a token-exchange request to obtain a new access token with a different audience or scope.

For Dremio, use Dremio's OIDC token-exchange endpoint (not the IdP's endpoint).
Token Exchange Additional Payload Info Use the additional payload fields to include the IdP OIDC token requests, such as client_id, grant_type, scope, and audience. Use the required format:

grant_type=urn:ietf:params:oauth:grant-type:token-exchange;client_id=client id value;scppe=scope value;subjet_token_type=urn:ietf:params:oauth:token-type:jwt
TLS
SSL encrypted communication occurs between the Arrow Flight SQL client and the Teradata instance. The following connector properties must be configured when setting up SSL.
Setting Description
Use TLS [Optional] Enable or disable TLS communication using the Arrow Flight SQL connector.

Default value: True
CA Certificate (PEM format) [Optional] Use the root certificate to validate the server certificate of the target Arrow Flight SQL-compliant database. The certificate must be in PEM format.
Dremio Sonar Project
SSL encrypted communication occurs between the Arrow Flight SQL client and the Teradata instance. The following connector properties must be configured when setting up SSL.
Setting Description
Project ID [Optional] The Dremio Sonar Project ID. If not specified, the default Sonar project is used.