M↓ View as Markdown ↗

MariaDB¶

Connect a MariaDB database to Actian AI Analyst so you can build Models on its tables and let your AI Analysts query them.

Availability

Who can do this: members with the Edit capability in the active Workspace. If your organization has turned on Restrict connection management, you also need the Manage organization capability.
Plan: Studio lists only the connectors that your organization's plan and your deployment include. If MariaDB is missing from the list, ask your administrator.
Deployment: Actian SaaS and self-managed deployments.

To connect MariaDB, you:

Create a dedicated read-only user.
Optionally, require SSL for that user.
Allow AI Analyst's IP addresses through your firewall or network rules.
Add the connection in Studio.

Queries are read-only

AI Analyst runs the queries behind answers, Models, Metrics and previews inside a read-only transaction, so MariaDB refuses data changes made through those queries. No write or admin permissions are needed. Still use a dedicated user that can only read the data you want to expose. See Read-only access.

1. Create a read-only user in MariaDB¶

Create a separate technical user for AI Analyst with read-only permissions:

-- Replace with your database name and a secure password
CREATE USER 'analyst_user'@'%' IDENTIFIED BY '<your_secure_password>';

-- Grant read access to the database
GRANT SELECT ON your_database.* TO 'analyst_user'@'%';

-- Apply changes
FLUSH PRIVILEGES;

This user can only read from the specified database. To restrict access further, grant SELECT on individual tables instead. Each database you grant access to appears as a schema that you can expose in Studio.

2. Optional: require SSL for the user¶

If your MariaDB server is configured with SSL certificates, you can require encrypted connections for the AI Analyst user:

-- Require SSL for this user (optional)
ALTER USER 'analyst_user'@'%' REQUIRE SSL;

If you do this, set SSL mode to Require or Require (no verify) when you add the connection (step 4). SSL is not required by default, but it is recommended for production environments to protect data in transit.

3. Allow AI Analyst to reach your server¶

If your MariaDB server is behind a firewall or network rules, allow inbound connections on its port (3306 by default) from AI Analyst's outbound IP addresses:

Actian SaaS: when your deployment publishes its outbound addresses, the Setup help panel next to the connection form lists them under Which IPs to allow. If the panel doesn't list any addresses, contact Actian support for them.
Self-managed deployment: allow the outbound addresses of your own AI Analyst installation. If the database has a private network address, your operator must also allow that private range for warehouse connections.

See Network access for details.

4. Add the connection in Studio¶

In Studio, open Connections, click + (Add connection) and choose MariaDB under Warehouses.
Under Connection details, enter a Name. Names must be unique among the connections you can see. See Connections and Workspaces. Optionally add a Description.
Optionally, tick Private to this Workspace so that only the active Workspace can see and use the connection. See Who can see the connection.

Under Credentials, fill in the fields:

Field	Value
Host	Your server's hostname or IP address, without a protocol (no `https://`)
Port	`3306` by default
Database	The database you granted access to
Username	`analyst_user`
Password	The password you set in step 1
SSL mode	Disable by default. Choose Require if your server enforces SSL. See SSL mode.

Instead of typing each field, you can click Paste a connection string, paste a string such as mariadb://user:password@host:3306/database, and click Fill the form. Nothing is sent until you test the connection.

Click Test connection. When the test succeeds, Schemas appears and lists the databases the user can see. The first one is selected.
The preselected database is exposed by default. To change it, select the databases to expose for browsing and model authoring. Changing the selection resets the test, so click Test connection again afterwards. Your selection is kept.
Click Save connection. The button stays disabled until a test succeeds and the connection has a name.

Studio opens the new connection. Credentials are encrypted at rest and are never shown again after saving. To browse tables, re-test the connection or update credentials later, see Manage connections.

SSL mode¶

The SSL mode options behave as follows in AI Analyst:

SSL mode	Encrypts the connection	Verifies the server certificate
Disable (default)	No	No
Require	Yes	Yes
Require (no verify)	Yes	No
Verify CA	Yes	No. It currently behaves like Require (no verify).
Verify full	Yes	Yes

Choose Require to encrypt the connection and verify the server certificate. If your server uses a self-signed certificate or one issued by a private certificate authority, choose Require (no verify). Uploading CA certificates or client certificates (client cert and key) is not supported.

Who can see the connection¶

A new connection is attached to the Workspace you are working in.

Organization connection (default): an organization admin can attach it to other Workspaces later.
Private to this Workspace: only this Workspace can see or use it. An organization admin can later share it with the whole organization. A shared connection can't be made private again.

See Connections and Workspaces.

Local and private addresses

If you enter localhost, a private IP address or a hostname without a domain, the form shows This looks like a local address. The form doesn't block you, but you can only save after a successful test, and the test only succeeds if AI Analyst's servers can reach the address and your deployment allows it. AI Analyst refuses private addresses unless the deployment allows that range. On a self-managed deployment, ask your operator to allow it. See Network access. localhost points to the server AI Analyst connects from, not to your computer.

Next steps¶

Before people can ask questions about this data:

Create Models on the tables you want to analyse.
Add the Models to an AI Analyst.

You can also monitor the connection's health.

Troubleshooting¶

Message after Test connection or Save connection	Likely cause and fix
Fill in … before testing the connection	A required field is empty. Fill in the fields it names.
Authentication failed	Check the Username and Password. If the user requires SSL, set SSL mode to Require or Require (no verify).
Could not reach the warehouse	Check the Host and Port, and that your firewall allows AI Analyst's IP addresses (step 3).
Could not establish a secure connection	The SSL settings don't match the server. See SSL mode.
This warehouse user cannot see those objects	Grant `SELECT` as shown in step 1.
The test succeeds but Schemas doesn't appear	The user can't see any database. Check the grants in step 1. The request to list schemas can also fail after the test (a brief error appears). Click Test connection again.
Warehouse host is not allowed	The host is a private or blocked address, doesn't resolve, or includes a protocol, path or port. Use a publicly reachable host name, or on a self-managed deployment ask your operator to allow the private range. See Network access.
A connection with this name already exists	Choose a different Name. This message appears after you click Save connection.