JDBC configuration properties

BASIC

CONNECTOR_SNOWFLAKE_JDBC_URL

This property is used to set the JDBC URL, which can be used to connect to the Snowflake server. The JDBC URL should be formatted as follows: jdbc:snowflake://testsnowflake.snowflakecomputing.com/?warehouse=<WAREHOUSE_TO_USE>&role=<ROLE_TO_USE> Example :- jdbc:snowflake://testsnowflake.snowflakecomputing.com/?warehouse=PRIVACERA_POLICYSYNC_WH&role=PRIVACERA_SYNC_ROLE

BASIC

CONNECTOR_SNOWFLAKE_JDBC_USERNAME

This property is used to specify the JDBC username that will be used to connect to Snowflake.

BASIC

CONNECTOR_SNOWFLAKE_JDBC_PASSWORD

This property is used to specify the JDBC username password that will be used to connect to Snowflake.

BASIC

CONNECTOR_SNOWFLAKE_WAREHOUSE_TO_USE

This property is used to specify which JDBC warehouse will be used to establish a connection in order to run SQL queries on Snowflake.

BASIC

CONNECTOR_SNOWFLAKE_ROLE_TO_USE

This property is used to specify the Snowflake role that will be used to run SQL queries on Snowflake.

BASIC

CONNECTOR_SNOWFLAKE_OWNER_ROLE

This property is used to specify who owns all of the resources managed by policysync. The specified role will become the owner of all managed resources and will have complete control over those resources. We support changing the owner of a database, schema, tables, and views.Generally value of this should be same as SNOWFLAKE_ROLE_TO_USE property value to be used to execute queries. NOTE: If the owner role is left blank, ownership will not change, and users who create tables/views or other objects will be the owner of those objects, and policysync will not be able to control access to those objects.

BASIC

CONNECTOR_SNOWFLAKE_MANAGE_WAREHOUSE_LIST

This property is used to specify the names of comma-separated warehouses for which policysync should manage access control. If you want to manage all warehouses, you can skip this property. This also works with wildcards. The ignore warehouses list takes precedence over the manage warehouses list. For example, testdb1warehouse, testdb2warehouse, sales dbwarehouse*. **NOTE: values for this property are case-sensitive.

BASIC

CONNECTOR_SNOWFLAKE_MANAGE_DATABASE_LIST

This property is used to specify comma-separated database names for which policysync should manage access control. If you want to manage all databases, you can skip this property. This also accepts wildcards. The manage database list takes precedence over the ignore database list. For example, testdb1, testdb2, sales db* **NOTE: values for this property are case-sensitive.

ADVANCED

CONNECTOR_SNOWFLAKE_MANAGE_SCHEMA_LIST

This property is used to set comma separated schema Fqdn which access control should be managed by policysync. If you want to manage all schemas then you can skip specifying this property. This supports wildcards as well. The ignore schema list has precedence over manage schema list. Eg. testdb1.schema1,testdb2.schema2,sales_db*.sales* **NOTE: values for this property are case-sensitive.

ADVANCED

CONNECTOR_SNOWFLAKE_MANAGE_TABLE_LIST

This property is used to set comma separated table/view Fqdn which access control should be managed by policysync. If you want to manage all tables/views then you can skip specifying this property. This supports wildcards as well. The ignore table list has precedence over manage table list. Eg. testdb1.schema1.table1,testdb2.schema2.view2,sales_db*.sales*.* **NOTE: values for this property are case-sensitive.

ADVANCED

CONNECTOR_SNOWFLAKE_MANAGE_STREAM_LIST

This property is used to set comma separated streams Fqdn which access control should be managed by policysync. If you want to manage all streams then you can skip specifying this property. This supports wildcards as well. The ignore streams list has precedence over manage streams list. Eg. testdb1.schema1.streams1,testdb2.schema2.streams2,sales_db*.sales*.* **NOTE: values for this property are case-sensitive.

ADVANCED

CONNECTOR_SNOWFLAKE_MANAGE_FUNCTION_LIST

This property is used to set comma separated functions Fqdn which access control should be managed by policysync. If you want to manage all functions then you can skip specifying this property. This supports wildcards as well. The ignore functions list has precedence over manage functions list. Eg. testdb1.schema1.functions1,testdb2.schema2.functions2,sales_db*.sales*.* **NOTE: values for this property are case-sensitive.

ADVANCED

CONNECTOR_SNOWFLAKE_MANAGE_PROCEDURE_LIST

This property is used to set comma separated procedures Fqdn which access control should be managed by policysync. If you want to manage all procedures then you can skip specifying this property. This supports wildcards as well. The ignore procedures list has precedence over manage procedures list. Eg. testdb1.schema1.procedures1,testdb2.schema2.procedures2,sales_db*.sales*.* **NOTE: values for this property are case-sensitive.

ADVANCED

CONNECTOR_SNOWFLAKE_MANAGE_SEQUENCE_LIST

This property is used to set comma separated sequences Fqdn which access control should be managed by policysync. If you want to manage all sequences then you can skip specifying this property. This supports wildcards as well. The ignore sequences list has precedence over manage sequences list. Eg. testdb1.schema1.sequence1,testdb2.schema2.sequence2,sales_db*.sales*.* **NOTE: values for this property are case-sensitive.

ADVANCED

CONNECTOR_SNOWFLAKE_MANAGE_FILE_FORMAT_LIST

This property is used to set comma separated FileFormats Fqdn which access control should be managed by policysync. If you want to manage all FileFormats then you can skip specifying this property. This supports wildcards as well. The ignore FileFormats list has precedence over manage FileFormats list. Eg. testdb1.schema1.FileFormat1,testdb2.schema2.FileFormat2,sales_db*.sales*.* **NOTE: values for this property are case-sensitive.

ADVANCED

CONNECTOR_SNOWFLAKE_MANAGE_PIPE_LIST

This property is used to set comma separated pipes Fqdn which access control should be managed by policysync. If you want to manage all pipes then you can skip specifying this property. This supports wildcards as well. The ignore pipes list has precedence over manage pipes list. Eg. testdb1.schema1.pipe1,testdb2.pipe2.FileFormat2,sales_db*.sales*.* **NOTE: values for this property are case-sensitive.

ADVANCED

CONNECTOR_SNOWFLAKE_MANAGE_EXTERNAL_STAGE_LIST

This property is used to set comma separated ExternalStage Fqdn which access control should be managed by policysync. If you want to manage all ExternalStage then you can skip specifying this property. This supports wildcards as well. The ignore ExternalStage list has precedence over manage ExternalStage list. Eg. testdb1.schema1.ExternalStage1,testdb2.ExternalStage2.FileFormat2,sales_db*.sales*.* **NOTE: values for this property are case-sensitive.

ADVANCED

CONNECTOR_SNOWFLAKE_MANAGE_INTERNAL_STAGE_LIST

This property is used to set comma separated InternalStage Fqdn which access control should be managed by policysync. If you want to manage all InternalStage then you can skip specifying this property. This supports wildcards as well. The ignore InternalStage list has precedence over manage InternalStage list. Eg. testdb1.schema1.InternalStage1,testdb2.InternalStage2.FileFormat2,sales_db*.sales*.* **NOTE: values for this property are case-sensitive.

ADVANCED

CONNECTOR_SNOWFLAKE_IGNORE_WAREHOUSE_LIST

This property is used to set comma separated warehouse names which access control you don't want to be managed by policysync. If you don't want to ignore any warehouse then you can skip specifying this property. This supports wildcards as well. This has precedence over manage warehouse list. Eg. testdb1warehouse,testdb2warehouse,sales_dbwarehouse* **NOTE: values for this property are case-sensitive.

ADVANCED

CONNECTOR_SNOWFLAKE_IGNORE_DATABASE_LIST

This property is used to set comma separated database names which access control you don't want to be managed by policysync. If you don't want to ignore any database then you can skip specifying this property. This supports wildcards as well. This has precedence over manage database list. Eg. testdb1,testdb2,sales_db* **NOTE: values for this property are case-sensitive.

ADVANCED

CONNECTOR_SNOWFLAKE_IGNORE_SCHEMA_LIST

This property is used to set comma separated schema fqdn which access control you don't want to be managed by policysync. If you don't want to ignore any schema then you can skip specifying this property. This supports wildcards as well. This has precedence over manage schema list. Eg. testdb1.schema1,testdb2.schema2,sales_db*.sales* **NOTE: values for this property are case-sensitive.

ADVANCED

CONNECTOR_SNOWFLAKE_MANAGE_USERS

This property controls whether policysync should manage the membership between user and user role.

SNOWFLAKE_MANAGE_ENTITIES

ADVANCED

CONNECTOR_SNOWFLAKE_MANAGE_GROUPS

This property controls whether we should create role in snowflake for groups fetched from ranger.

SNOWFLAKE_MANAGE_ENTITIES

ADVANCED

CONNECTOR_SNOWFLAKE_MANAGE_ROLES

This property controls whether we should create role in snowflake for roles fetched from ranger.

SNOWFLAKE_MANAGE_ENTITIES

ADVANCED

CONNECTOR_SNOWFLAKE_MANAGE_USER_LIST

This property is used to set comma separated user names which access control should be managed by policysync. If you want to manage all users then you can skip specifying this property. This supports wildcards as well. The ignore users list has precedence over manage users list. Eg. user1,user2,dev_user*

ADVANCED

CONNECTOR_SNOWFLAKE_MANAGE_GROUP_LIST

This property is used to set comma separated group names which access control should be managed by policysync. If you want to manage all group then you can skip specifying this property. This supports wildcards as well. The ignore group list has precedence over manage group list. Eg. group1,group2,dev_group*

ADVANCED

CONNECTOR_SNOWFLAKE_MANAGE_ROLE_LIST

This property is used to set comma separated role names which access control should be managed by policysync. If you want to manage all role then you can skip specifying this property. This supports wildcards as well. The ignore role list has precedence over manage role list. Eg. role1,role2,dev_role*

ADVANCED

CONNECTOR_SNOWFLAKE_IGNORE_USER_LIST

This property is used to set comma separated user names which access control you don't want to be managed by policysync. If you don't want to ignore any users then you can skip specifying this property. This supports wildcards as well. This has precedence over manage users list. Eg. user1,user2,dev_user*

ADVANCED

CONNECTOR_SNOWFLAKE_IGNORE_GROUP_LIST

This property is used to set comma separated group names which access control you don't want to be managed by policysync. If you don't want to ignore any groups then you can skip specifying this property. This supports wildcards as well. This has precedence over manage groups list. Eg. group1,group2,dev_group*

ADVANCED

CONNECTOR_SNOWFLAKE_IGNORE_ROLE_LIST

This property is used to set comma separated role names which access control you don't want to be managed by policysync. If you don't want to ignore any roles then you can skip specifying this property. This supports wildcards as well. This has precedence over manage roles list. Eg. role1,role2,dev_role*

ADVANCED

CONNECTOR_SNOWFLAKE_USER_NAME_REPLACE_FROM_REGEX

This takes the regular expression as input and finds the matching characters in a user name and replaces them with the characters specified in property. If kept blank, no find and replace operation is performed.

[~`$&+:;=?@#|'<>.^*()_%\\\\[\\\\]!\\\\-\\\\/\\\\\\\\{}]

ADVANCED

CONNECTOR_SNOWFLAKE_USER_NAME_REPLACE_TO_STRING

The value specified in this property is used to replace the characters found by the regex specified user name regex property. If kept blank, no find and replace operation is performed.

_

ADVANCED

CONNECTOR_SNOWFLAKE_GROUP_NAME_REPLACE_FROM_REGEX

This takes the regular expression as input and finds the matching characters in a group name and replaces them with the characters specified in property. If kept blank, no find and replace operation is performed.

[~`$&+:;=?@#|'<>.^*()_%\\\\[\\\\]!\\\\-\\\\/\\\\\\\\{}]

ADVANCED

CONNECTOR_SNOWFLAKE_GROUP_NAME_REPLACE_TO_STRING

The value specified in this property is used to replace the characters found by the regex specified group name regex property. If kept blank, no find and replace operation is performed.

_

ADVANCED

CONNECTOR_SNOWFLAKE_ROLE_NAME_REPLACE_FROM_REGEX

This takes the regular expression as input and finds the matching characters in a role name and replaces them with the characters specified in property. If kept blank, no find and replace operation is performed.

[~`$&+:;=?@#|'<>.^*()_%\\\\[\\\\]!\\\\-\\\\/\\\\\\\\{}]

ADVANCED

CONNECTOR_SNOWFLAKE_ROLE_NAME_REPLACE_TO_STRING

The value specified in this property is used to replace the characters found by the regex specified role name regex property. If kept blank, no find and replace operation is performed.

_

ADVANCED

CONNECTOR_SNOWFLAKE_USER_NAME_PERSIST_CASE_SENSITIVITY

After loading user from Ranger API's all are converted into lowercase, but in some cases, you would need to have the users in the same case as they are in Ranger. When setting this value to true, it will maintain the case sensitivity of names as they are in Ranger.

false

true/false

ADVANCED

CONNECTOR_SNOWFLAKE_GROUP_NAME_PERSIST_CASE_SENSITIVITY

After loading group from Ranger API's all are converted into lowercase, but in some cases, you would need to have the users in the same case as they are in Ranger. When setting this value to true, it will maintain the case sensitivity of names as they are in Ranger.

false

true/false

ADVANCED

CONNECTOR_SNOWFLAKE_ROLE_NAME_PERSIST_CASE_SENSITIVITY

After loading role from Ranger API's all are converted into lowercase, but in some cases, you would need to have the users in the same case as they are in Ranger. When setting this value to true, it will maintain the case sensitivity of names as they are in Ranger.

false

true/false

ADVANCED

CONNECTOR_SNOWFLAKE_MANAGE_USER_FILTERBY_GROUP

Set this property to true, if you want to manage only the users who belongs to the groups defined in manage groups list property.

false

true/false

ADVANCED

CONNECTOR_SNOWFLAKE_MANAGE_USER_FILTERBY_ROLE

Set this property to true, if you want to manage only the users who belongs to the roles defined in manage roles list property.

false

true/false

BASIC

CONNECTOR_SNOWFLAKE_GRANT_UPDATES

This property controls whether actual grant/revoke and create/update/delete queries for user/group/role should be run on snowflake.

true

true/false

ADVANCED

CONNECTOR_SNOWFLAKE_ENABLE_MASKING

This property controls whether to enable native masking policy creation functionality in policysync.

true

ADVANCED

CONNECTOR_SNOWFLAKE_MASKING_POLICY_DB_NAME

This property used to set the database name in which policysync should create custom masking policies

ADVANCED

CONNECTOR_SNOWFLAKE_MASKING_POLICY_SCHEMA_NAME

This property used to set the schema name in which policysync should create all native masking policies, if this is kept as blank then it will consider the resource schema as masking policy schema

public

BASIC

This property used to set the database name in which policysync should create custom masking functions

ADVANCED

CONNECTOR_SNOWFLAKE_ENABLE_ROW_FILTER

This property controls whether to enable native tr filter policy creation functionality in policysync.

true

ADVANCED

CONNECTOR_SNOWFLAKE_ROW_FILTER_POLICY_DB_NAME

This property used to set the database name in which policysync should create all native tr filter policies, if this is kept as blank then it will consider the resource database as tr filter policy database

ADVANCED

CONNECTOR_SNOWFLAKE_ROW_FILTER_POLICY_SCHEMA_NAME

This property used to set the schema name in which policysync should create all native tr filter policies, if this is kept as blank then it will consider the resource schema as tr filter policy schema

PUBLIC

ADVANCED

CONNECTOR_SNOWFLAKE_ENABLE_VIEW_BASED_ROW_FILTER

Set this property to true, if you want to enable secure view based tr filter in postgres policysync. Note :- Postgres support native tr filters, but due to its some limitations we recommended to use view based tr filter.

FALSE

ADVANCED

CONNECTOR_SNOWFLAKE_ENABLE_VIEW_BASED_MASKING

Set this property to true, if you want to enable secure view based masking in postgres policysync. Note :- Postgres don't support native masking yet, thus recommended to use view based masking.

FALSE

ADVANCED

CONNECTOR_SNOWFLAKE_SECURE_VIEW_SCHEMA_NAME_PREFIX

By default view-based tr filter and masking related secure views have the same schema name as the table schema name. If you want to change the secure view schema name prefix and postfix, that can be done with these properties. After prefix and postfix is specified the view schema name will be in this format : {prefix}{view_schema_name}{postfix} For {view_schema_name} refer to variable POSTGRES_SECURE_VIEW_SCHEMA_NAME

ADVANCED

CONNECTOR_SNOWFLAKE_SECURE_VIEW_SCHEMA_NAME_POSTFIX

By default view-based tr filter and masking related secure views have the same schema name as the table schema name. If you want to change the secure view schema name prefix and postfix, that can be done with these properties. After prefix and postfix is specified the view schema name will be in this format : {prefix}{view_schema_name}{postfix} For {view_schema_name} refer to variable POSTGRES_SECURE_VIEW_SCHEMA_NAME

ADVANCED

CONNECTOR_SNOWFLAKE_SECURE_VIEW_NAME_PREFIX

By default view-based tr filter and masking related secure views have the same name as the table name with postfixed by _secure. If you want to change the secure view name prefix and postfix, that can be done with these properties. After prefix and postfix is specified the view name will be in this format : {prefix}{table_name}{postfix}

ADVANCED

CONNECTOR_SNOWFLAKE_SECURE_VIEW_NAME_POSTFIX

By default view-based tr filter and masking related secure views have the same name as the table name with postfixed by _secure. If you want to change the secure view name prefix and postfix, that can be done with these properties. After prefix and postfix is specified the view name will be in this format : {prefix}{table_name}{postfix}

_SECURE

ADVANCED

CONNECTOR_SNOWFLAKE_SECURE_VIEW_CREATE_FOR_ALL

Set this property to true, if you want to create secure view for all tables as well all view which were created by end users. This will create secure view for resource regardless whether there any masking/tr filter policy exists in ranger.

false

ADVANCED

CONNECTOR_SNOWFLAKE_MASKED_NUMBER_VALUE

This property used to set the value of the masked column of datatype number

0

ADVANCED

CONNECTOR_SNOWFLAKE_MASKED_TEXT_VALUE

This property used to set the value of the masked column of datatype text

'<MASKED>'