Get Connected to SQL Data Sources

This tutorial explains the basic steps to connect the Curity Identity Server to a SQL database. The content includes some demo local deployments for development computers. Once connected, you can plan your real database deployments.

Get a Default Configuration

First, follow these getting started tutorials.

• Get a license file, run an Install using Docker and sign into the Admin UI.
• Run the First Configuration, select All Options and accept all default settings.
• Export Configuration so that you have a curity-config.xml file.

Get Schema Initialization Scripts

Get the schema initialization script from the $IDSVR_HOME/etc folder of the Curity Identity Server. For example, you can run the following Docker commands.

docker pull curity.azurecr.io/curity/idsvr
docker run --name curity -d -e PASSWORD=Password1 curity.azurecr.io/curity/idsvr
docker cp curity:/opt/idsvr/etc/ ./etc/
docker rm --force curity

Study the resources and view the SQL creation script for your preferred provider.

postgres-create_database.sql
mssql-create_database.sql
mysql-create_database.sql
oracle-create_database.sql

Deploy the System

The following examples demonstrate simple ways to get connected on a development computer. You can configure data source details in the Admin UI by navigating to Facilities → Data Sources. The following sections instead demonstrate the XML configuration settings, so that you can plan rollouts to deployment pipelines.

<facilities xmlns="https://curity.se/ns/conf/base">
  <data-sources>
    <data-source>
      <id>default-datasource</id>
      <jdbc xmlns="https://curity.se/ns/ext-conf/jdbc">
        <connection-string>jdbc:postgresql://dbserver/idsvr</connection-string>
        <standard-credentials-mode>
        </standard-credentials-mode>
        <driver>org.postgresql.Driver</driver>
        <password>Password1</password>
        <username>idsvruser</username>
      </jdbc>
    </data-source>
  </data-sources>
...    
</facilities>

services:
  curity-data:
    image: postgres:latest
    hostname: dbserver
    container_name: dbserver
    volumes:
      - ./etc/postgres-create_database.sql:/docker-entrypoint-initdb.d/init.sql
      - ./data:/var/lib/postgresql/data
    environment:
      POSTGRES_USER: 'idsvruser'
      POSTGRES_PASSWORD: 'Password1'
      POSTGRES_DB: 'idsvr'

  curity-idsvr:
    image: curity.azurecr.io/curity/idsvr:latest
    hostname: idsvr
    container_name: idsvr
    ports:
      - 6749:6749
      - 8443:8443
    volumes:
      - ./license.json:/opt/idsvr/etc/init/license/license.json
      - ./curity-config.xml:/opt/idsvr/etc/init/config.xml
    environment:
      ADMIN: 'true'

docker exec -it dbserver bash

export PGPASSWORD=Password1 && psql -p 5432 -d idsvr -U idsvruser

SELECT * FROM accounts;

Finalize Deployments

Once connected, plan deployments to real environments that follow the provider's database best practices. Configure least privilege database users with strong client credentials and encrypt data at rest. See the system admin guide for details on the Database System Requirements and the finer details for each JDBC Data Source.

Finally, use the techniques in the Configuration as Code tutorial to finalize the database configuration for deployed systems. Use parameterized configuration and cryptographically protect sensitive database values.

<facilities xmlns="https://curity.se/ns/conf/base">
    <data-sources>
      <data-source>
        <id>default-datasource</id>
        <jdbc xmlns="https://curity.se/ns/ext-conf/jdbc">
          <connection-string>#{DB_CONNECTION}</connection-string>
          <standard-credentials-mode>
          </standard-credentials-mode>
          <driver>#{DB_DRIVER}</driver>
          <password>#{DB_PASSWORD}</password>
          <username>#{DB_USER}</username>
          <use-for-audit>true</use-for-audit>
        </jdbc>
      </data-source>
    </data-sources>
...    
</facilities>

Summary

The Curity Identity Server supports the main transactional databases that organizations use for their business data. You can deploy identity data anywhere and follow the same processes and techniques for both business data and identity data. For example, you can use the same database administration standards, for operations like encrypting data at rest, clustering and snapshotting.

Join our Newsletter

Get the latest on identity management, API Security and authentication straight to your inbox.

Email

Subscribe

I agree to Curity's Privacy Policy

Start Free Trial

Try the Curity Identity Server for Free. Get up and running in 10 minutes.

Start Free Trial