Connectors and authentication: prepare the correct contract
A Connection defines endpoint metadata, authentication and credential custody. A Mapping component selects that Connection and declares its operation. The worker supplies the actual driver, network access and runtime identity. These are three separate contracts: saving a Connection does not prove that every read, write, pagination or recovery mode is supported.
Use the matrix to prepare the visible form. Asterisks mark fields required by the catalog; provider or method validation may add requirements. Ports are initial values, not directions to open networks. Use only authorized endpoints, resource identifiers and principals.
Declared connection catalog
| Connector | Initial endpoint / port | Specific metadata | Declared methods |
|---|---|---|---|
| PostgreSQL | Host / 5432 | database, schema |
username_password, client_certificate, aws_iam, azure_workload_identity, gcp_iam, kerberos |
| MySQL | Host / 3306 | database * |
username_password, client_certificate |
| MariaDB | Host / 3306 | database * |
username_password, client_certificate |
| Microsoft SQL Server | Host / 1433 | database *, schema |
username_password |
| Oracle Database | Host / 1521 | database *, schema |
username_password |
| Snowflake | Account host / 443 | account, database *, schema, warehouse *, role |
snowflake_key_pair, username_password, bearer_token |
| Google BigQuery | HTTPS API endpoint / 443 | database, schema |
service_account_json, oauth_client_credentials, workload_identity, attached_service_account |
| Databricks | Workspace host / 443 | httpPath *, catalog *, schema |
personal_access_token, oauth_client_credentials |
| Amazon S3 | HTTPS S3 endpoint / 443 | bucket *, region |
access_key, aws_iam |
| Azure Blob Storage | Storage account URL / 443 | container *, directoryId |
oauth_client_credentials, sas_token, account_key, azure_managed_identity, azure_workload_identity |
| Google Cloud Storage | HTTPS API endpoint / 443 | bucket *, project * |
attached_service_account, workload_identity, service_account_json |
| Salesforce | Salesforce HTTPS URL / 443 | apiVersion * |
oauth_client_credentials, jwt_bearer |
| Dynamics 365 | Dataverse HTTPS URL / 443 | directoryId * |
oauth_client_credentials, azure_managed_identity, azure_workload_identity |
| Odoo | Odoo HTTPS URL / 443 | database * |
api_key |
| REST API | Base HTTPS URL / 443 | — | api_key, bearer_token, oauth_client_credentials, client_certificate, workload_identity, no_auth |
| SAP HANA | HANA host / 39015 | database *, schema |
username_password |
| SAP S/4HANA / ECC | SAP HTTPS URL / 443 | — | bearer_token, basic_auth |
| Oracle NetSuite | NetSuite account URL / 443 | account * |
bearer_token |
| MongoDB | MongoDB host / 27017 | database *, authSource, mongoScheme * |
username_password |
| FTP / SFTP | File server host / 22 | protocol *, rootPath * |
username_password, key_pair |
| Teradata | Teradata host / 1025 | database *, schema |
username_password, ldap |
| Elasticsearch / OpenSearch | Cluster HTTPS URL / 443 | — | api_key, basic_auth, bearer_token |
| Microsoft SharePoint | SharePoint site URL / 443 | directoryId *, siteId * |
oauth_client_credentials, azure_managed_identity, azure_workload_identity |
| ServiceNow | ServiceNow instance URL / 443 | — | bearer_token, basic_auth |
| HubSpot | HubSpot API URL / 443 | — | bearer_token |
The installed catalog and worker capability may offer a smaller effective set. Attached cloud identities do not automatically work outside their runtime. PostgreSQL has its own integration path; a generic connector registry alone should not be treated as its complete support boundary.
Step-by-step preparation
- Identify the target resource and the read/write operation you actually need.
- Select the matching connector in Connections and inspect required metadata.
- Choose the supported custody model and one of its offered authentication methods.
- Prepare the identity, protected credentials and resource permissions with the environment owner.
- Confirm a compatible worker, required driver and authorized network route.
- Save the Connection and test its stored configuration.
- Run a small authorized extraction or controlled write through the intended Mapping/Session.
- Verify records and destination effects independently; expand scope only after the small case succeeds.
Authentication preparation
| Declared method | Preparation and limits |
|---|---|
username_password, basic_auth, ldap |
A username and protected password, with the required identity/provider policy. |
client_certificate |
Certificate/private-key material and passphrase when required, through protected custody. |
kerberos |
A service principal and Kerberos environment available at runtime. |
aws_iam |
A runtime IAM identity; database authentication may also need a user/role. S3 uses the attached identity. |
azure_managed_identity, azure_workload_identity |
The supported managed/application identity and permissions on the actual resource. |
gcp_iam |
An IAM principal authorized for database authentication. |
snowflake_key_pair |
Snowflake user and a protected private key; the form recommends encrypted PKCS#8. |
oauth_client_credentials |
Client ID, protected secret, and provider-required audience or scope. |
workload_identity, attached_service_account |
Supported federation/role or an account attached to the execution environment. |
service_account_json |
A protected service-account document, not a pasted screenshot or shared file. |
access_key, sas_token, account_key |
Resource-scoped access metadata and protected secret material. |
api_key |
Required header/parameter name and protected value; Odoo uses its own user-key contract. |
bearer_token, personal_access_token, jwt_bearer |
The provider-specific token or signing identity, with adequate permissions and validity. |
key_pair |
SSH user/private key for SFTP only. |
no_auth |
A resource permitting unauthenticated access; it grants no resource permission by itself. |
Metadata and protocol differences
BigQuery Database means Project ID and Schema means Dataset. Oracle Database is its Service name. Databricks needs HTTP path and Catalog. Snowflake Database/Warehouse are different fields from Role/Schema. Do not exchange these concepts simply because all values are text.
Salesforce uses the authorized My Domain URL and its configured integration. Dynamics 365 needs Directory/tenant context and the environment scope. Odoo identifies its JSON-2 API for version 19 or later. SharePoint adds a site identifier or relative site path. Confirm the current provider contract for your environment.
FTP/SFTP protocol selection changes defaults and offered methods: SFTP starts at port 22; FTP/FTPS at 21. SSH key authentication is not offered for non-SFTP protocols. FTP is not encrypted transport. Use the required protocol and TLS policy.
Custody, verification and recovery
Dova Worker Agent keeps the secret in the customer runtime. Customer vault uses a protected external reference. Passwordless uses runtime identity without a stored reusable secret. Dova Vault is an exception path with protected encrypted input; Managed reference uses existing managed references. A valid-looking reference still requires runtime authorization and network access.
For a failed test, inspect safe messages, endpoint/TLS, identity permission, expiry and driver compatibility. Keep credentials and vault references out of evidence. For partial or duplicate writes, inspect destination semantics before retrying. Continue with Connections and Mapping components.