[{"data":1,"prerenderedAt":649},["ShallowReactive",2],{"docs-\u002Fdocs\u002Fconnections\u002Fdatabricks-lakebase":3},{"id":4,"title":5,"body":6,"description":640,"extension":641,"meta":642,"navigation":643,"path":644,"redirect":645,"seo":646,"stem":647,"__hash__":648},"docs\u002Fdocs\u002Fconnections\u002Fdatabricks-lakebase.md","Databricks Lakebase Guide",{"type":7,"value":8,"toc":628},"minimark",[9,13,25,28,33,91,95,98,134,141,144,148,155,161,167,223,229,234,249,272,275,296,314,318,328,336,343,349,355,362,417,423,429,433,440,443,446,461,525,528,534,557,564,568,600,604,624],[10,11,5],"h1",{"id":12},"databricks-lakebase-guide",[14,15,16,17,24],"p",{},"Use this page when a PostgreSQL connection in DBConvert Streams points at\n",[18,19,23],"a",{"href":20,"rel":21},"https:\u002F\u002Fdocs.databricks.com\u002Faws\u002Fen\u002Foltp\u002Fprojects\u002F",[22],"nofollow","Databricks Lakebase",", the managed\nPostgres that runs inside a Databricks workspace.",[14,26,27],{},"Lakebase speaks the PostgreSQL wire protocol, so the standard connection form applies.",[29,30,32],"h2",{"id":31},"what-works","What works",[34,35,36,49],"table",{},[37,38,39],"thead",{},[40,41,42,46],"tr",{},[43,44,45],"th",{},"Direction",[43,47,48],{},"Supported",[50,51,52,61,68,75],"tbody",{},[40,53,54,58],{},[55,56,57],"td",{},"Lakebase as target, Load",[55,59,60],{},"Yes",[40,62,63,66],{},[55,64,65],{},"Lakebase as target, CDC",[55,67,60],{},[40,69,70,73],{},[55,71,72],{},"Lakebase as source, Load",[55,74,60],{},[40,76,77,80],{},[55,78,79],{},"Lakebase as source, CDC",[55,81,82,86,87],{},[83,84,85],"strong",{},"No"," - see ",[18,88,90],{"href":89},"#lakebase-as-a-cdc-source","Lakebase as a CDC source",[29,92,94],{"id":93},"enable-password-connections","Enable password connections",[14,96,97],{},"Lakebase accepts Databricks OAuth identities by default. Those tokens expire after one\nhour, so they cannot drive a stored connection or a long-running stream. DBConvert Streams\nneeds a native Postgres role with a password.",[99,100,101,113,123],"ol",{},[102,103,104,105,108,109,112],"li",{},"Open the Lakebase project in the Databricks workspace and click ",[83,106,107],{},"Settings"," in the left\nsidebar, under ",[83,110,111],{},"PROJECT",".",[102,114,115,116,119,120,112],{},"Scroll to ",[83,117,118],{},"Database connections"," and tick ",[83,121,122],{},"Password (Native postgres roles)",[102,124,125,126,129,130,133],{},"Click ",[83,127,128],{},"Save",", then ",[83,131,132],{},"Allow"," in the confirmation dialog.",[14,135,136],{},[137,138],"img",{"alt":139,"src":140},"Database connections settings with Password enabled and the confirmation dialog open","\u002Fimages\u002Fdocs\u002Fconnections\u002Fdatabricks-lakebase\u002Fallow-password-connections.png",[14,142,143],{},"The warning in that dialog is worth reading rather than clicking past: password logins on a\npublicly reachable database do widen the attack surface, and Databricks recommends OAuth\ninstead. If your security policy forbids enabling this, no external tool can connect to that\nLakebase project at all.",[29,145,147],{"id":146},"create-the-role","Create the role",[14,149,150,151,154],{},"Open your branch and switch to the ",[83,152,153],{},"Roles & Databases"," tab.",[14,156,157],{},[137,158],{"alt":159,"src":160},"Roles and Databases tab in a Lakebase branch","\u002Fimages\u002Fdocs\u002Fconnections\u002Fdatabricks-lakebase\u002Froles-and-databases.png",[14,162,125,163,166],{},[83,164,165],{},"Add role",", then:",[99,168,169,180,192,217],{},[102,170,171,172,175,176,179],{},"Set ",[83,173,174],{},"Authentication type"," to ",[83,177,178],{},"Password",". Databricks generates the password for you.",[102,181,182,183,187,188,191],{},"Enter a name, for example ",[184,185,186],"code",{},"dbc_user",". Do not leave a leading space - the name is taken\nas typed, and a role named ",[184,189,190],{},"\" dbc_user\""," is not the one you will type into a connection\nstring.",[102,193,194,195,200,201,204,205,208,209,212,213,216],{},"Tick ",[83,196,197],{},[184,198,199],{},"databricks_superuser"," so the role can read and write data and create tables.\nLeave ",[83,202,203],{},"System attributes"," alone: ",[184,206,207],{},"CREATEDB",", ",[184,210,211],{},"CREATEROLE"," and ",[184,214,215],{},"BYPASSRLS"," are Postgres\nrole attributes, not access to your data, and a stream needs none of them unless it\nshould create a database of its own.",[102,218,125,219,222],{},[83,220,221],{},"Add",", then copy the generated password.",[14,224,225],{},[137,226],{"alt":227,"src":228},"Add role dialog with Password authentication and databricks_superuser selected","\u002Fimages\u002Fdocs\u002Fconnections\u002Fdatabricks-lakebase\u002Fadd-role.png",[230,231,233],"h3",{"id":232},"creating-the-role-in-sql-instead","Creating the role in SQL instead",[14,235,236,237,240,241,244,245,248],{},"A role created with ",[184,238,239],{},"CREATE ROLE"," starts with no privileges of its own, so grant them in the\nsame session. PostgreSQL 15 and later no longer give ",[184,242,243],{},"CREATE"," on ",[184,246,247],{},"public"," to every role, and\nwithout it a stream that creates tables stops before it writes anything.",[250,251,256],"pre",{"className":252,"code":253,"language":254,"meta":255,"style":255},"language-sql shiki shiki-themes github-light github-dark","CREATE ROLE dbc_user LOGIN PASSWORD 'a-long-random-password';\nGRANT CREATE, USAGE ON SCHEMA public TO dbc_user;\n","sql","",[184,257,258,266],{"__ignoreMap":255},[259,260,263],"span",{"class":261,"line":262},"line",1,[259,264,265],{},"CREATE ROLE dbc_user LOGIN PASSWORD 'a-long-random-password';\n",[259,267,269],{"class":261,"line":268},2,[259,270,271],{},"GRANT CREATE, USAGE ON SCHEMA public TO dbc_user;\n",[14,273,274],{},"For a role that only reads:",[250,276,278],{"className":252,"code":277,"language":254,"meta":255,"style":255},"CREATE ROLE dbc_reader LOGIN PASSWORD 'a-long-random-password';\nGRANT USAGE ON SCHEMA public TO dbc_reader;\nGRANT SELECT ON ALL TABLES IN SCHEMA public TO dbc_reader;\n",[184,279,280,285,290],{"__ignoreMap":255},[259,281,282],{"class":261,"line":262},[259,283,284],{},"CREATE ROLE dbc_reader LOGIN PASSWORD 'a-long-random-password';\n",[259,286,287],{"class":261,"line":268},[259,288,289],{},"GRANT USAGE ON SCHEMA public TO dbc_reader;\n",[259,291,293],{"class":261,"line":292},3,[259,294,295],{},"GRANT SELECT ON ALL TABLES IN SCHEMA public TO dbc_reader;\n",[297,298,301],"alert",{"title":299,"type":300},"Tables owned by someone else","info",[14,302,303,304,306,307,310,311,112],{},"This applies to a role without ",[184,305,199],{},". Such a role cannot read a table\ncreated by your Databricks identity until you grant it, and the symptom is confusing:\n",[184,308,309],{},"information_schema"," hides columns the connected user has no rights on, so the table appears\nin Data Explorer with its indexes but no columns at all. Grant access to it, or transfer\nownership with ",[184,312,313],{},"ALTER TABLE ... OWNER TO dbc_user",[29,315,317],{"id":316},"connect","Connect",[14,319,320,321,323,324,327],{},"Open ",[83,322,317],{}," on the project dashboard and set ",[83,325,326],{},"Role"," to the password role you just\ncreated. The dialog defaults to your Databricks identity, which produces an OAuth\nconnection string - one that expects a token valid for an hour where the password goes.\nFeeding that to DBConvert Streams fails with:",[250,329,334],{"className":330,"code":332,"language":333,"meta":255},[331],"language-text","ERROR: Provided authentication token is not a valid JWT encoding (SQLSTATE 28P01)\n","text",[184,335,332],{"__ignoreMap":255},[14,337,338,339,342],{},"With the password role selected, leave ",[83,340,341],{},"Connection pooling"," off and copy the connection\nstring. It carries the role's password, so treat it as a secret.",[14,344,345],{},[137,346],{"alt":347,"src":348},"Connect dialog with the password role selected and connection pooling off","\u002Fimages\u002Fdocs\u002Fconnections\u002Fdatabricks-lakebase\u002Fconnect-dialog.png",[250,350,353],{"className":351,"code":352,"language":333,"meta":255},[331],"postgresql:\u002F\u002Fdbc_user:password@ep-example-1234.database.us-east-2.cloud.databricks.com:5432\u002Fdatabricks_postgres?sslmode=require\n",[184,354,352],{"__ignoreMap":255},[14,356,357,358,361],{},"In the DBConvert Streams connection form, paste it into ",[83,359,360],{},"Quick fill",", or enter the parts:",[34,363,364,374],{},[37,365,366],{},[40,367,368,371],{},[43,369,370],{},"Field",[43,372,373],{},"Value",[50,375,376,386,396,407],{},[40,377,378,381],{},[55,379,380],{},"Host",[55,382,383],{},[184,384,385],{},"ep-\u003Cname>-\u003Cid>.database.\u003Cregion>.cloud.databricks.com",[40,387,388,391],{},[55,389,390],{},"Port",[55,392,393],{},[184,394,395],{},"5432",[40,397,398,401],{},[55,399,400],{},"Database",[55,402,403,406],{},[184,404,405],{},"databricks_postgres"," (the default database of a new project)",[40,408,409,412],{},[55,410,411],{},"SSL Mode",[55,413,414],{},[184,415,416],{},"Require",[418,419],"themed-image",{"alt":420,"dark":421,"light":422},"DBConvert Streams PostgreSQL connection form filled from a Lakebase connection string, reporting Connection Successful","\u002Fimages\u002Fdocs\u002Fconnections\u002Fdatabricks-lakebase\u002Fnew-connection-dark.png","\u002Fimages\u002Fdocs\u002Fconnections\u002Fdatabricks-lakebase\u002Fnew-connection-light.png",[14,424,425,426,428],{},"Lakebase refuses unencrypted connections, so SSL is mandatory and no certificate files are\nneeded. A recognized connection shows a ",[83,427,23],{}," badge in Data Explorer.",[29,430,432],{"id":431},"lakebase-as-a-target","Lakebase as a target",[14,434,435,436,112],{},"DBConvert Streams writes to Lakebase with ordinary SQL, so nothing on the target side is\nspecific to it. Follow ",[18,437,439],{"href":438},"\u002Fdocs\u002Fconnections\u002Fpostgresql-server","PostgreSQL Server Configuration",[29,441,90],{"id":442},"lakebase-as-a-cdc-source",[14,444,445],{},"A Lakebase database cannot be a CDC source, and no configuration changes that.",[14,447,448,449,452,453,456,457,460],{},"Everything the server reports suggests otherwise: ",[184,450,451],{},"wal_level"," is ",[184,454,455],{},"logical",", replication\nslots are free, and a role created through the Databricks UI carries ",[184,458,459],{},"rolreplication",".\nSlots can even be created. What fails is the publication that logical decoding needs:",[34,462,463,473],{},[37,464,465],{},[40,466,467,470],{},[43,468,469],{},"Operation",[43,471,472],{},"Result",[50,474,475,486,496,504,513],{},[40,476,477,482],{},[55,478,479],{},[184,480,481],{},"SELECT current_setting('wal_level')",[55,483,484],{},[184,485,455],{},[40,487,488,493],{},[55,489,490],{},[184,491,492],{},"pg_create_logical_replication_slot(...)",[55,494,495],{},"succeeds",[40,497,498,501],{},[55,499,500],{},"Replication connection",[55,502,503],{},"opens",[40,505,506,511],{},[55,507,508],{},[184,509,510],{},"CREATE_REPLICATION_SLOT ... EXPORT_SNAPSHOT",[55,512,495],{},[40,514,515,520],{},[55,516,517],{},[184,518,519],{},"CREATE PUBLICATION ...",[55,521,522],{},[83,523,524],{},"fails",[14,526,527],{},"The refusal comes back as:",[250,529,532],{"className":530,"code":531,"language":333,"meta":255},[331],"ERROR: [Databricks Auth] Feature not supported by Databricks. (SQLSTATE 0A000)\n",[184,533,531],{"__ignoreMap":255},[14,535,536,452,539,542,543,546,547,550,551,556],{},[184,537,538],{},"0A000",[184,540,541],{},"feature_not_supported",", not a privilege error, and the ",[184,544,545],{},"[Databricks Auth]","\nprefix places it in the Databricks proxy rather than in Postgres. There is no ",[184,548,549],{},"GRANT"," that\nlifts it. Databricks documents the restriction as\n",[18,552,555],{"href":553,"rel":554},"https:\u002F\u002Fdocs.databricks.com\u002Faws\u002Fen\u002Foltp\u002Fprojects\u002Fcompatibility",[22],"logical replication being unavailable","\nand offers Lakehouse Sync for moving Lakebase tables into Delta.",[14,558,559,560,563],{},"A stream with Lakebase as its source therefore stops at the CDC handoff. Use ",[83,561,562],{},"Load"," mode\nto copy a snapshot out of Lakebase; the data transfers normally.",[29,565,567],{"id":566},"verification-checklist","Verification checklist",[99,569,570,575,583],{},[102,571,572,573,112],{},"Test the connection from the connection editor. A TLS failure means SSL Mode is not\n",[184,574,416],{},[102,576,577,578,582],{},"Open the database in ",[18,579,581],{"href":580},"\u002Fdocs\u002Fdatabase-explorer\u002F","Data Explorer"," and confirm the schemas\nand tables you expect are visible. Missing columns on a visible table means the role\nlacks privileges on it, not that the table is empty.",[102,584,585,586,589,590,593,594,596,597,599],{},"For a target stream, confirm the role can create tables. DBConvert Streams checks this\nbefore the first write and reports ",[184,587,588],{},"PREFLIGHT_TARGET_NOT_WRITABLE"," with\n",[184,591,592],{},"permission denied for schema public"," when it cannot - either because the role was\ncreated in SQL without the ",[184,595,549],{},", or because ",[184,598,199],{}," was left unticked.",[29,601,603],{"id":602},"related-docs","Related docs",[605,606,607,611,618],"ul",{},[102,608,609],{},[18,610,439],{"href":438},[102,612,613,617],{},[18,614,616],{"href":615},"\u002Fdocs\u002Fconnections\u002Fneon-database","Neon PostgreSQL Guide"," - Lakebase runs on the same engine",[102,619,620],{},[18,621,623],{"href":622},"\u002Fdocs\u002Fintegration\u002Fpostgres-cdc-source-configuration","PostgreSQL CDC Source Configuration",[625,626,627],"style",{},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":255,"searchDepth":268,"depth":268,"links":629},[630,631,632,635,636,637,638,639],{"id":31,"depth":268,"text":32},{"id":93,"depth":268,"text":94},{"id":146,"depth":268,"text":147,"children":633},[634],{"id":232,"depth":292,"text":233},{"id":316,"depth":268,"text":317},{"id":431,"depth":268,"text":432},{"id":442,"depth":268,"text":90},{"id":566,"depth":268,"text":567},{"id":602,"depth":268,"text":603},"Connect DBConvert Streams to Databricks Lakebase - native Postgres role setup, target configuration, and why Lakebase cannot be a CDC source.","md",{},false,"\u002Fdocs\u002Fconnections\u002Fdatabricks-lakebase",null,{"title":5,"description":640},"docs\u002Fconnections\u002Fdatabricks-lakebase","Pw2m-Nh_DRHex00Z-ODYGlT3x-rpqTPSBbnp4LA1P5g",1787081872536]