nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Authenticating for Compass API and JDBC driver

Enrico Menotti

What is the "proper" (recommended) way to set up authentication for using the Compass API and the JDBC driver? (It's two questions actually…)

In API Gateway, I have defined two Authorized Apps, one for the Compass API and one for the JDBC driver. For the former, I have used "Client Credentials" as Grant Type, downloaded the credentials, and used them (from Microsoft Fabric) as if they were Username and Password. For the latter, I have used "Password Credentials"; this requires a user to authenticate (we tested with a generic SQL tool, if I'm not wrong it was dbeaver). Both connections do work, but I'm unsure on whether these be the most appropriate ways to go; in particular, I could not figure out which Security Role is needed for the user in the "Password Credentials" case (we just tested with a full suite admin user).

Find more posts tagged with

Authentication

Accepted answers

Brandon Watson

Did you review the doc for how to setup for third-party tools? I dont remember using saak or sask like that. They detail the Driver and class names in the doc, along with the url template. You can either include the ionapi credentials file in the connection string in the url template or place the file in a directory with the exact name "Infor Compass JDBC Driver.ionapi", i usually put it in the same directory as the JAR. Then add the JAR file and the folder path to the libraries for DBeaver.

https://docs.infor.com/inforos/latest/en-us/useradminlib_cloud/default.html?helpcontent=datafabrug/krz1639350786272.html

I had never tried a Service User with no roles, but I just tested and get the no authorization error when trying to load the tables. It appears to be working as expected to me. However, in Data Fabric, I have enabled the Data Security and setup proper roles for things.

All comments

Brandon Watson

Hello Enrico - For any API user, I always start with IONAPI-User role as that gives access to all endpoints in the gateway. Then some of the applications may require additional roles like DATALAKE-XXXX or DATAFABRIC-XXXX depending if you have Data Security enabled or not and/or what roles have access to what tables/fiels through the Security modules in Data Fabric.

I would think you would want to use Password Credentials for MS Fabric, as the refresh token could be used. The password credentails will have CI/CS and SAAK/SASK. I typically create a Service User for tied to the Service Account when downloading the credentials. I use these same steps for the Compass JDBC, uness i want that specific credential to be tied to a specific user for security purposes.

The tied user/service user follows all security within the system so there could be many other use cases and combinations, but yours sounds like a typical connection for one or many admins to use from a third-party app. Hopefully this all makes sense.

Enrico Menotti

Hi Brandon,

Thank you for your reply. To be honest, I'm not sure I really understand all the details. In the meanwhile, I had also opened a ticket with Infor Support, asking the very same question as in this post. Their reply is based on the official docs, and goes like:

For APIs, use Client Credentials;
For JDBC, use Password Credentials, by creating a Service Account.

Also, in the second case, according to them, the user authenticating should have the "DATAFABRIC-SuperAdmin" Security Role.

We do not have Data Security enabled.

So my follow-up questions:

API case. You suggest using Password Credentials, to have the refresh token available, right? I don't understand what the use of the refresh token is, to be honest. My idea was to simply request a new token at the start of every refresh run (typically once per day) and use it throughout the run. To this aim, Client Credentials sound like the simplest approach, don't they?
JDBC case. Is it possible to use Client Credentials here, or the driver simply doesn't work this way? Besides that, when you talk about Service User, do you mean a "normal" user used only to be tied to the Service Account to define the needed Security Roles? Considering we don't have Data Security, do we really need the DATAFABRIC-SuperAdmin as stated by Support?

Brandon Watson

Thanks for that additional information. I understand that Client Credentials can work, but with Infor adding the new Service Users capabilities, I have gone to creating a service user for any ionapi files I download. I just think it adds greater flexibility around permissions. Using Client Credentials is like always using the highest security level with no granular capabilities and is really meant for application-to-application communication.

The refresh token is dependent on the third-party app capabilities. With your plan of a set of calls once a day you would not really need to worry about refresh token. Also with client credentials you do not want to use refresh token at all. For the password type you are sending service account credentials every time you make the first Token call, which is a security risk. Instead of sending every time for token, you can then switch to rolling refresh tokens and not sending the security credentials.

I thought JDBC would work with Client Creds, but I just tried with my DBeaver setup and it was unable to connect. It seems the password creds are required here. When I say Service User, I mean the new menu option Service Users. These users cannot login to the Portal and are great for password creds. I add Service Users here and add the IONAPI-User and whatever else is needed. The SuperAdmin role will just give that user access to evertyhing, which may be overkill, and approach support likes to take. You could Enable Data Security and then give very specific access by Security Role to whomever you want. In the case of JDBC, you really dont need access to everything. You just need access to Data Lake and Compass, and maybe the Data Catalog or Metagraphs.

Enrico Menotti

Thank you for the details. I have gone the simple way suggested by Support (SuperAdmin), for now it's ok.

However I'd like to understand exactly how Service Users are to be used. I have followed the procedure in the docs: when I download the .ionapi file, I define a Service User tied to my user. But then? Should I use the user + pass of the Service User to authenticate? Will that give me the access that has been granted to the tied (normal) user? Not yet understanding this, I have created a separate normal user and used its credentials for the login, and given it the SuperAdmin role. This worked, but I'm still wondering what I have created the Service User for.

Brandon Watson

Lets say you want to integrate a 3rd party/vendor to your DataLake, so they can retrieve data. However, you dont want that vendor to be able to to do everything in Data Fabric. So you instead give them DATAFABRIC-User role which only has access to compass and schema. Maybe you even take it farther and give them access to specific table(s) and field(s) only as well. That granularity is an example of not using the SuperAdmin role. You don't really "login" wtih ionapi files, those are just credential contents used for OAuth 2 tokens for the API Gateway. If the SAAK and SASK fields exist, it means you selected the option to create the service account when downloading. The program/person using the credentials file should always use everything available in it, as far as CI/CS SAAK/SASK go. The other items for token enpoints. I would also recommend to check out the below links as there is a lot of useful information.

https://github.com/infor-cloud/ion-api-sdk

https://developer.infor.com/tutorials/api-gateway

Kevin Heiman

Adding to Brandon's reply , there are numerous conversations on this topic sprinkled throughout Community forum.
one is a reply that I shared code on how to use the .api file properly for dynamic application use;

Other related topics are on best practices of API use (retry, backoff, jitter) , error handling tracing, and Token refreshing with code examples. All are critical to having a successful / quality API client.
Also check on Infor YouTube channel.

Enrico Menotti

Well here's what we did.

In DBeaver, used the SAAK and SASK of the Service Account in the fields Username and Password of the connection. This works.
Defined a Service User with NO Security Roles and put it in the field "User Name" for the Service Account. The connection still works (!).

So I still don't get the use of the Service User, or in general of the User tied to the Service Account. It looks like no role on that user is needed.

On the other hand, we noticed that a user with DATAFABRIC-User can access Data Fabric (from the UI, I mean) but has basically nothing there (no Atlas, no Compass). A user with DATAFABRIC-SuperAdmin has everything. I have not been able to find any intermediate role - is there any (by default)?

PS I just tested with postman as well. Authenticated (got the token) by the Service Account as above (with tied Service User having no Security Roles), Password grant. Ran a query, retrieved the result - all fine.

Enrico Menotti

@Brandon Watson @Kevin Heiman Do you have any comment on my last post? Thank you!

Brandon Watson

Enrico Menotti

Yes I had read over that doc. I did not set up DBeaver myself. I believe we went by "Option 1 - Incorporating the security credentials using the .ionapi file in the same directory as the driver". However, it looks like DBeaver asks anyway for Username and Password; initially we used a normal user (SuperAdmin etc.), then we tried with SAAK and SASK and it worked. Maybe in the future I will try DBeaver on my own and see if I can understand a bit more.

It is weird that in our environment it be sufficient to have a Service Account without any specific Security Role, but apparently this is it.

For the moment I will leave things as they are: if I enable security on Data Fabric I run the risk of breaking something in the company processes.

Many thanks for your comments. Very illuminating.

Brandon Watson

Thats odd, I had never gotten the dbeaver prompt for those, but I always included them in my IONAPI file. I dont know if that is anything to do with it.

I would definitely enable data security in TST/TRN first. Hopefully you have copies of all your integrations there.

Copyright © 2026 Infor. All rights reserved.