Summary of security-related options
- Last Updated: April 8, 2026
- 1 minute read
- DataDirect Connectors
- ODBC
- Apache Spark SQL 8.0
- Documentation
The following tables summarizes how security-related connection options work with the drivers. See Connection option descriptions or click on the option name for details about configuring the options.
| Option | Description | Default |
|---|---|---|
| User ID/Password Authentication | ||
| Authentication Method | If set to 0 (User
ID/Password), the driver sends the user ID in clear text and an encrypted password to
the server for authentication. If set to 4 (Kerberos Authentication), the driver uses Kerberos authentication. This method supports both Windows Active Directory Kerberos and MIT Kerberos environments. If set to -1 (No Authentication), the driver sends the user ID and password in clear text to the server for authentication. |
0 (User ID/Password) |
| Proxy User | Specifies the UserID used for HiveServer2 Impersonation and HiveServer2 Trusted Impersonation. | None |
| User Name | The default user ID used to connect to your database. | None |
| Additional options for session cookie based authentication (HTTP Mode only) | ||
| Cookie Name | Specifies the name of the cookie used for authenticating HTTP requests when HTTP
mode (TransportMode=1) and session cookie based
authentication are enabled (EnableCookieAuthentication=1). When preparing an HTTP request to the
server, the driver will not attempt to reauthenticate if a valid cookie is present. |
hive.server2.auth
|
| Enable Cookie Authentication |
Determines whether the driver attempts to use session cookie based authentication for requests to an HTTP endpoint after the initial authentication to the server. Cookie based authentication improves response time by eliminating the need to re-authenticate with the server for each request. If set to 0 (Disabled), the driver does not use cookie based authentication for HTTP requests after the initial authentication. If set to 1 (Enabled), the driver attempts to use cookie based authentication for requests to an HTTP endpoint after the initial authentication to the server. The cookie used for authentication is specified by the Cookie Name option. If the name does not match, or authentication fails, the driver attempts to authenticate using user ID and password authentication. |
1 (Enabled) |
| Option | Description | Default |
|---|---|---|
| Authentication Method | If set to 0
(User ID/Password), the driver sends the user ID in clear text and an encrypted
password to the server for authentication. If set to 4 (Kerberos Authentication), the driver uses Kerberos authentication. This method supports both Windows Active Directory Kerberos and MIT Kerberos environments. If set to -1 (No Authentication), the driver sends the user ID and password in clear text to the server for authentication. |
0 (User ID/Password) |
| GSS Client Library | The name of the GSS client library that the driver uses to communicate with the Key Distribution Center (KDC). | native |
| Proxy User | Specifies the UserID used for HiveServer2 Impersonation and HiveServer2 Trusted Impersonation. | None |
| Service Principal Name | The service principal name to be used by driver for Kerberos authentication. | None |
| User Name | The default user ID used to connect to your database. | None |
| Option | Description | Default |
|---|---|---|
| Crypto Protocol Version | Specifies a comma-separated list of the cryptographic protocols to use when SSL is enabled using the Encryption Method connection option (EncryptionMethod=1). | TLSv1.2, TLSv1.3 |
| CryptoLibName | The absolute path for the OpenSSL library file containing the cryptographic library to be used by the data source or connection when SSL is enabled. The cryptograpic library contains the implementations of cryptographic algorithms the driver uses for data encryption. | Empty string |
| Enable FIPS | Determines whether the OpenSSL library uses cryptographic algorithms from the
FIPS provider or the default provider when TLS/SSL encryption is enabled
(Encryption Method=1).If disabled, the OpenSSL library uses cryptographic algorithms from the default provider. If enabled, the OpenSSL library uses cryptographic algorithms from the FIPS provider. |
Default: Disabled |
| Encryption Method | If set to 0
(No Encryption), data is not encrypted. If set to 1 (SSL), data is encrypted using the SSL protocols specified in the Crypto Protocol Version connection option. |
|
| Host Name In Certificate | A host name for certificate validation when SSL encryption is enabled and validation is enabled. | None |
| Key Password | Specifies the password used to access the individual keys in the keystore file when SSL is enabled (Encryption Method=1) and SSL client authentication is enabled on the database server. | None |
| Key Store | The name of the directory containing the keystore file to be used when SSL is enabled (Encryption Method=1) and SSL client authentication is enabled on the database server. | None |
| Key Store Password | The password used to access the keystore file when SSL is enabled (Encryption Method=1) and SSL client authentication is enabled on the database server. | None |
| PRNGSeedFile
(UNIX and Linux only) |
Specifies the absolute path for the entropy-source file or device used as a seed for SSL key generation. | /dev/random |
| PRNGSeedSource
(UNIX and Linux only) |
Specifies the source of the seed the driver uses for SSL key generation. Seeds are a pseudorandom or random value used to set the initial state of the random number generator used to generate SSL keys. Using seeds with a higher level of entropy, or randomness, provides a more secure transmission of data encrypted using SSL. |
0 (File) |
| SSLLibName | The absolute path for the OpenSSL library file containing the SSL library to be used by the data source or connection when SSL is enabled. The SSL library contains the implementations of SSL protocols the driver uses for data encryption. | Empty string |
| Trust Store | The directory that contains the truststore file and the truststore file name to be used when SSL is enabled and server authentication is used. | None |
| Trust Store Password | Specifies the password that is used to access the truststore file when SSL is enabled and server authentication is used. | None |
| Validate Server Certificate | If set to 1 (Enabled), the driver validates the certificate that is sent by the database server. Any certificate from the server must be issued by a trusted CA in the truststore file. If the Host Name In Certificate option is specified, the driver also validates the certificate using a host name. | 1 (Enabled) |