Connect non-Snowflake providers

The nine non-Snowflake providers share a connection composer pattern: open the Catalog tile, paste a DSN or fill the provider-specific form, save, and verify. This article covers the shared pattern and the per-provider quirks.

Audience: IT (the enabler)

The shared composer

Every non-Snowflake provider opens the same composer with three sections:

• Paste connection details accepts the provider's native env block, URL form, JDBC URL, or key=value DSN. The form below populates from the paste.
• Provider-specific form carries the connection name, host, port, database, credentials, and any provider quirks.
• Save with a friendly name and Test from the Connected tab afterward.

All providers default Query mutability to read_only. Set it to read_write only when a workload genuinely needs to write back.

Default ports

The composer pre-fills Port based on the provider:

Per-provider notes

MySQL

Set TLS mode to required, verify_ca, or verify_identity for managed databases. Paste a CA PEM only when the server requires certificate verification. The connecting user needs SELECT on the target tables.

Oracle

Connects in thin mode. Prefer Service name (for example orclpdb1); fall back to SID (for example ORCLCDB) or DSN (an Easy Connect string like dbhost.example.com/orclpdb1) when service-name resolution is unavailable.

MSSQL (Microsoft SQL Server)

Pick Authentication: SQL username + password or Entra OAuth.

• SQL username + password. Fill Username and Password. Set Encrypt to optional, mandatory, or strict. Trust server certificate disables certificate validation; only enable for development.
• Entra OAuth. The browser opens a Microsoft sign-in popup. Encryption defaults to mandatory. Tenant admins manage the shared Entra app under Configuration; this form only needs the SQL Server connection details.

The composer accepts SQL Server env blocks, mssql:// URLs, jdbc:sqlserver:// URLs, and semicolon-delimited ODBC or ADO.NET strings. ODBC driver defaults to ODBC Driver 18 for SQL Server.

ClickHouse

Defaults to HTTP on port 8123. Check Use HTTPS / TLS for production. Set Compression to enabled, lz4, or zstd to reduce network usage on large result sets. The native protocol on 9000 is not exposed.

BigQuery

Service-account authentication. Paste the service-account JSON or upload the downloaded credential file. Billing project ID defaults from the JSON; set a Data project ID when the dataset lives in a different project. Dataset and Location (for example US, EU) are optional.

Databricks

Set Server hostname (for example dbc-123456.cloud.databricks.com) and HTTP path (for example /sql/1.0/warehouses/abc123). Pick Auth mode token (paste a personal access token) or oauth_m2m (machine-to-machine OAuth with a client ID and client secret). Catalog is exposed at query time; Schema stays connection-scoped.

Redshift

Pick Auth mode password (username and password) or iam (AWS region, DB user, an optional cluster identifier or serverless workgroup, and AWS credentials). For serverless workgroups, the IAM role needs redshift-serverless:GetCredentials. Place the platform's source IP range in the cluster's security group.

TimescaleDB

A Postgres-form variant. Set Schema (defaults to public) and an optional SSL mode. The platform verifies the TimescaleDB extension during the connection test.

Postgres

See the dedicated Postgres article.

Verify any connection

After saving, open the connection's drawer on the Connected tab. Click Run test in the Settings tab or the inline button when the connection needs polling. The Status section shows last sync and last test; the Readiness tiles fill in schemas, relations, and profiled counts as discovery runs.

Common errors

• Network timeout. The platform cannot reach the host. Confirm the platform's egress IPs are allowed by the database's firewall or security group.
• Authentication failed. The credentials or auth mode are wrong. Re-test from the composer; for OAuth-based providers, re-authorize through the popup.
• Schema or database not found. The connecting role lacks USAGE on the schema or database, or the names are mistyped.
• Run test returns auth_expired. The token or refresh credential expired. Open the drawer and click Reconnect.
• Partial query history. Discovery fetched a shorter history window than configured. Acceptable for most workloads; widen the role's history visibility when query-log driven features need it.

See also

• Snowflake for the dedicated dialog and Profiles tab.
• Postgres for the Postgres-specific walkthrough.
• Snowflake Profiles for workspace-wide Snowflake credential reuse.