generated: '2026-08-29'
method: searched
source: https://docs.sqream.com/en/latest/operational_guides/access_control.html
docs:
- https://docs.sqream.com/en/latest/operational_guides/access_control.html
- https://docs.sqream.com/en/latest/configuration_guides/ldap.html
- https://docs.sqream.com/en/latest/reference/cli/sqream_sql.html
note: >-
  SQream has no HTTP API and therefore no HTTP security schemes — there is no apiKey header, no
  bearer token, no OAuth 2.0 flow and no OpenID Connect discovery document (every
  /.well-known/openid-configuration and /.well-known/oauth-authorization-server probe 404s; see
  well-known/sqream-technologies-well-known.yml). Authentication happens at the database connection:
  a role name and password are presented over SQream's wire protocol by the client driver or CLI, and
  authorization is role-based access control in the database itself. Because there is no OAuth
  surface, no scopes/ artifact is emitted — the permission model is SQL GRANT/REVOKE, not scopes.
transport: SQream wire protocol over TCP (default port 5000 standalone, 3108 via the load balancer)
schemes:
- id: role-password
  type: basic-credentials
  location: connection handshake
  parameters:
  - username
  - password
  description: >-
    A SQreamDB role name and its password, supplied on connect via --username/--password (CLI) or the
    equivalent driver connection parameters. Passwords are prompted interactively when omitted.
  source: https://docs.sqream.com/en/latest/reference/cli/sqream_sql.html
- id: ldap
  type: directory
  description: >-
    LDAP authentication against Microsoft Active Directory or another directory service. Only roles
    with admin privileges or higher may enable it; once enabled, authorization for all existing and
    newly added roles is handled by the LDAP server, with the exception of the initial deployment
    `sqream` role which retains full control permissions.
  source: https://docs.sqream.com/en/latest/configuration_guides/ldap.html
authorization:
  model: RBAC (role-based access control)
  description: >-
    SQreamDB manages authentication and authorization with role-based access control in the manner of
    ANSI SQL. Permissions are of two kinds — global permissions, held by SUPERUSER roles, granting
    unrestricted access to all system and database activity; and object-level permissions, assignable
    to non-SUPERUSER roles over databases, schemas, tables, functions, views, foreign tables, catalogs
    and services.
  source: https://docs.sqream.com/en/latest/operational_guides/access_control.html
transport_security:
  tls: optional
  description: >-
    Traffic in and out of SQreamDB can be encrypted with TLS, configured manually on the connector
    (ODBC, JDBC and the SQL client's --ssl flag). TLS is not on by default — the CLI's --ssl flag
    defaults to false.
  source: https://docs.sqream.com/en/latest/reference/cli/sqream_sql.html