Skip to main content

How Atlan connects to IBM Db2 for LUW

TL;DR

Understand how Atlan securely connects to your IBM Db2 for LUW server to extract metadata.

Connect

Atlan connects to your IBM Db2 for Linux, UNIX, and Windows (LUW) server to extract technical metadata while maintaining network security and compliance. You can choose between Direct connectivity for servers available from the internet or Self-Deployed Runtime for servers that must remain behind your firewall.

Connect via direct network connection​

Atlan's IBM Db2 for LUW workflow establishes a direct network connection to your server from the Atlan SaaS tenant. This approach works when your Db2 server can accept connections from the internet.

Direct extraction

  • Atlan's IBM Db2 for LUW workflow connects directly to your server from the Atlan SaaS tenant over port 50000 (default), using the IBM Data Server Driver for JDBC and SQLJ (the jcc type 4 driver).
  • Your Db2 server accepts inbound network connections from Atlan's IP addresses, controlled through your firewall rules or network security groups.
  • You can encrypt the connection with SSL/TLS by uploading a JKS or PKCS12 truststore, or by uploading the server or certificate authority (CA) certificate directly as an .arm or .pem file, when configuring the crawler. Encrypted connections typically use port 50001.

For details on how direct connectivity works, see Direct connectivity.

Connect via self-deployed runtime​

A runtime service deployed within your network acts as a secure bridge between Atlan Cloud and your Db2 for LUW server. This approach works when your server must remain fully isolated behind your firewall.

Self-deployed runtime extraction

  • The runtime maintains an outbound HTTPS connection to Atlan Cloud (port 443) and a local network connection to your Db2 server (port 50000 by default).
  • The runtime translates requests into read-only SQL queries, runs them against the Db2 system catalog, and returns the extracted metadata to Atlan Cloud.

For details on how Self-Deployed Runtime works, see SDR connectivity.

Connection behavior​

  • A Db2 for LUW connection reaches exactly one database. To crawl several databases on the same host, list each database and port pair under Databases when you configure the crawler, and the connector opens one connection per pair against the shared host.
  • Each database must appear only once. If you list the same database twice on different ports, the connector crawls the first pair and skips the rest, because a database maps to exactly one connection.
  • Db2 for LUW has a straightforward database, schema, and table hierarchy, so every asset Atlan catalogs sits under its owning database.
  • The connector runs its catalog queries sequentially rather than in parallel, which respects the limit your server places on concurrent sessions.
  • Lineage comes from the SQL definitions of views, stored procedures, and functions - the connector parses the SQL text the database records for each of them to build lineage between assets. Query history mining isn't supported for Db2 for LUW.

Security​

Atlan extracts only structural metadata - databases, schemas, tables, views, columns, and the definitions of views, stored procedures, and functions. For example, if you have a CUSTOMERS table with customer records, Atlan discovers the table structure and column definitions, but never queries or stores the customer records themselves.

  • Read-only operations: All queries are read-only SELECT statements against the database system catalog. The connector can't modify data, create or drop objects, or change any configuration. The Db2 privileges you grant control exactly what the connector can access.

  • Credential encryption: Db2 connection credentials are encrypted at rest and in transit. In Direct connectivity, Atlan encrypts credentials before storage. In Self-Deployed Runtime, credentials never leave your network perimeter - the runtime retrieves them from your enterprise-managed secret store only when needed, and Atlan Cloud never receives or stores them.

  • Network isolation with Self-Deployed Runtime: Your Db2 server gains complete network isolation from the internet. The server only accepts connections from the runtime within your local network. The runtime itself only makes outbound HTTPS connections to Atlan Cloud, which your network team can control through firewall rules.

See also​