Connect to Repository Through Impersonation

Connecting through impersonation uses an ALTR-issued temporary access token in place of a repository password. An Impersonation Policy determines which repository user’s credentials the sidecar uses for the resulting database session.

Prerequisites

• An Impersonation Policy exists mapping your identity provider (IdP) user or group to a repository user. See Allow Access to a Repository. This requires single sign-on (SSO) and SCIM to already be enabled in ALTR — see Identity Providers for Okta and Microsoft Entra ID setup.
• The repository, its repository users, and the sidecar are registered in ALTR. See Repositories and Manage Sidecar Information.

To connect to a repository through impersonation:

1. Sign in to ALTRNet with single sign-on (SSO).
2. Click New Access Token.
3. Select the Repository User you want to connect as. ALTR only lists repository users an Impersonation Policy maps to your IdP identity.
4. Select a Token Expiration. Connect to the repository before the token expires.
5. Click Generate Token, then click Copy to copy the token value.
6. Open a SQL client.
7. Enter the sidecar’s hostname and listener port in place of the repository’s own hostname and port.
8. Enter the repository user you selected as the username, and enter the access token in place of the repository user’s password.
9. Connect. The sidecar uses the Impersonation Policy to confirm the mapping and forwards the connection to the repository as that repository user.