ArpeNetezza — Connection guide

Everything you can put in front of ArpeNetezza to point it at a Netezza database, in one place: the three ways to supply connection details, every option the driver accepts, and the Netezza-specific rules (default port 5480, TLS negotiation in the HSV2 handshake, NPS 7 TLS versions).

For how authentication and TLS work, see Authentication. For the licence, see Licensing.

Connections open lazily

AdbcConnectionInit does not touch the network. The socket, TLS handshake and login happen at the first statement or metadata call. So a wrong host, port, password or TLS setting is reported by that first call, not by connect().

---

Three ways to connect

Every driver in the Arpeio family accepts the same three connection forms. They can be mixed; a discrete option always wins over the same field taken from a connection_string or a uri, regardless of the order they are set.

Form	Option key	Grammar	Best for
Discrete options	adbc.arpenz.<field>	one option per field	programmatic clients, secrets kept out of a single string
Connection string	adbc.arpenz.connection_string	ADO.NET Key=Value;…	pasting an existing string
Connection URI	uri	netezza://… URL	portable tooling

Python

import adbc_driver_manager.dbapi as dbapi

# Discrete options
conn = dbapi.connect(driver="arpenz", db_kwargs={
    "adbc.arpenz.server":   "nzhost",
    "adbc.arpenz.port":     "5480",
    "adbc.arpenz.database": "SYSTEM",
    "adbc.arpenz.username": "admin",
    "adbc.arpenz.password": "<pw>",
})

# Connection string (ADO.NET keywords)
conn = dbapi.connect(driver="arpenz", db_kwargs={
    "adbc.arpenz.connection_string":
        "Server=nzhost,5480;Database=SYSTEM;User ID=admin;Password=<pw>",
})

# Connection URI
conn = dbapi.connect(driver="arpenz", db_kwargs={
    "uri": "netezza://admin:<pw>@nzhost:5480/SYSTEM?sslmode=verify-full",
})

Precedence is per field. A field parsed from connection_string or uri is applied only if no discrete adbc.arpenz.* option set it. If both a connection_string and a uri set the same field, the one set last wins; avoid giving both.

---

Option reference

All options are string-typed and live under the adbc.arpenz.* namespace. Set them as ADBC database options before the database is initialised. An unknown key is rejected (NOT_IMPLEMENTED, "Unknown database option"). Statement and ingest options are set on the statement; see Statement & ingest options.

Target: where to connect

Option	Default	Meaning
adbc.arpenz.server (alias hostname)	localhost	Host name or IP.
adbc.arpenz.port (alias port)	5480	TCP port, 1..65535.
adbc.arpenz.database (alias database)	—	Netezza database to connect to, e.g. SYSTEM. There is no default: set it.
adbc.arpenz.application_name (alias application_name)	arpenetezza	Application name reported to the server. It is sent only when the server negotiates handshake protocol v4 or v6 (the fields Guardium reads), which includes NPS 11.

Authentication

Full detail is in Authentication.

Option	Values	Meaning
adbc.arpenz.username / .password (aliases username / password)	string	Netezza credentials. The server chooses how the password is sent: cleartext, MD5 or SHA-256 digest.
adbc.arpenz.require_password_encryption	true / false (default)	Refuse to send any password reply unless the connection is TLS-encrypted.
adbc.arpenz.trusted, adbc.arpenz.auth_type, adbc.arpenz.krb5.*	—	Integrated authentication (Kerberos / SSPI). Accepted as options, but refused at connect: Netezza integrated authentication is not supported.

Encryption / TLS

Option	Default	Meaning
adbc.arpenz.sslmode	prefer	disable / prefer / require / verify-ca / verify-full. See the table below. allow and any other value are rejected.
adbc.arpenz.ssl_root_cert	—	PEM CA file for verify-ca / verify-full. Unset: OpenSSL's default locations, which hold no CAs on RHEL and Windows (details).
adbc.arpenz.tls_min_version (alias tls_min_version)	from sslmode	Minimum TLS version: 1.0, 1.1, 1.2 or 1.3 (a TLS / TLSv prefix is accepted, TLSv1 means 1.0). Since v0.3.2.
adbc.arpenz.encrypt / adbc.arpenz.trust_server_cert	false / true	Older on/off switches, used only when sslmode is not set: encrypt=true means require, or verify-full with trust_server_cert=false. Prefer sslmode.

sslmode	Encrypts	Verifies the server	Default minimum TLS
disable	no	—	—
prefer (default)	if the server agrees	no	1.0
require	yes	no	1.2
verify-ca	yes	chain	1.2
verify-full	yes	chain and host name (or IP SAN)	1.2

The default prefer encrypts when the server offers TLS, but does not check its certificate and accepts TLS 1.0. If the server declines TLS, the session continues in clear. Use verify-full for anything that crosses an untrusted network.

Netezza 7.x servers only offer TLS 1.0 / 1.1: with require or stricter, set tls_min_version=1.0 (or 1.1). An encrypted NPS 7 connection is not yet validated; see Authentication → NPS 7. Where trusted certificates come from depends on the client OS: see Authentication → TLS.

adbc.arpenz.channel_binding and adbc.arpenz.gssencmode are accepted for compatibility with PostgreSQL-style strings, but Netezza has neither SCRAM nor GSS transport encryption: the value require is refused at connect, and every other value has no effect.

Timeouts & performance

Option	Default	Meaning
adbc.arpenz.login_timeout	30	TCP connect timeout, in seconds (0 = the 30 s default). It covers the TCP connect only, not the TLS handshake or the login.
adbc.arpenz.socket_timeout	0 (none)	Read/write timeout in seconds on the socket, for the TLS handshake, the login and every later exchange. 0 = no limit.
adbc.arpenz.query_timeout	0	Accepted and stored, but has no effect in v0.3.6. Cancel a long query with AdbcStatementCancel instead.
adbc.arpenz.buffer_size	32000	Rows per streamed Arrow batch, the default for each new statement. Range 1..10000000; a larger value is capped, a value ≤ 0 or non-numeric is ignored.

Type rendering (read path)

Option	Values	Meaning
adbc.arpenz.interval_type (alias interval_type)	text (default) / native	INTERVAL as utf8 text, or as Arrow interval(month_day_nano). Since v0.2.8. See Data types.
adbc.arpenz.char_encoding (alias char_encoding)	latin9 (default) / utf8	How CHAR / VARCHAR bytes are read: transcoded from LATIN9 to UTF-8, or passed through as UTF-8. Since v0.3.1.
adbc.arpenz.json_extension (alias json_extension)	off (default) / on	Tag JSON / JSONB columns with the arrow.json extension type. Since v0.2.8.

Ingest

Option	Values	Meaning
adbc.arpenz.ingest_method (alias ingest_method)	auto (default) / external / insert	Bulk-ingest path. auto uses the external-table load and falls back to batched INSERT when the load cannot express the ingest; external turns that fallback into an error; insert always uses INSERT. Since v0.3.0. See Data types → Write path.

Licence

Option	Meaning
arpeio.adbc.license	Licence blob, inline.
arpeio.adbc.license_file	Path to a .lic file.
arpeio.adbc.license.status	Read-only (GetOption); reports <state>;code=<ARROW_LIC_*>;tier=<tier>;expires=<epoch>.

The driver also reads the shared ARPEIO_ADBC_LICENCE[_FILE] environment variables and an arpeio_adbc.lic file next to the library. Full resolution order in Licensing.

Standard ADBC connection options

These use the ADBC-standard keys (no arpenz namespace):

Option	Values	Meaning
adbc.connection.autocommit	true (default) / false	Autocommit mode, settable on the database or the connection. With it off, Commit / Rollback drive an explicit transaction; with it on they are rejected.
adbc.connection.catalog	database name	Reports the connected database. Setting it checks the target database, then reconnects to it on the next statement; uncommitted work is lost.
adbc.connection.db_schema	schema name	Reports the current schema (CURRENT_SCHEMA). Setting it checks that the schema exists, then switches the session to it.

The adbc.arpenz.* read, TLS and ingest options above can also be set on a connection, before its first statement. login_timeout and socket_timeout are database options only.

Statement & ingest options

Set on the statement handle, not the database:

Option	Default	Meaning
adbc.arpenz.batch_size	buffer_size (32000)	Rows per Arrow batch for this statement, 1..max_batch_size.
adbc.arpenz.max_batch_size	1000000	Upper bound for batch_size.
adbc.ingest.target_table	—	Target table for adbc_ingest.
adbc.ingest.mode	—	adbc.ingest.mode.create / .append / .replace / .create_append (or the short forms create, …). Required for an ingest; any other value is rejected.
adbc.ingest.target_db_schema	—	Target schema; the table is written as "schema"."table".
adbc.ingest.temporary	false	true ingests into a CREATE TEMP TABLE. Needs a username and password on the connection.
adbc.ingest.target_catalog	—	Accepted but ignored: the ingest goes to the connected database.

adbc.arpenz.memory_budget_mb and adbc.arpenz.prefetch are accepted on a statement but have no effect.

Removed options

Since v0.3.0, options that only applied to PostgreSQL are rejected as unknown: adbc.arpenz.copy_format, adbc.arpenz.geospatial, adbc.arpenz.uuid_casing, and the arpenz.bulk_* statement options.

---

Connection string (ADO.NET form)

adbc.arpenz.connection_string accepts the ADO.NET Key=Value;… grammar: case-insensitive keywords, 'single' or "double" quoted values, doubled-quote escapes. An unknown keyword, or the same field given twice (including through two synonyms, e.g. Server and Data Source), is rejected.

Keyword(s)	Option
Server, Data Source, Address, Addr, Network Address	server and port: host, host,port, tcp:host,port, or [ipv6],port
Database, Initial Catalog	database
User ID, UID, User	username
Password, PWD	password (255 bytes max)
Application Name, App	application_name
Connection Timeout, Connect Timeout, Timeout	login_timeout
Encrypt	encrypt
TrustServerCertificate	trust_server_cert
RequirePasswordEncryption	require_password_encryption

Server=nzhost,5480;Database=SYSTEM;User ID=admin;Password=<pw>;Encrypt=true;TrustServerCertificate=false

There is no Port keyword: give the port in Server as host,port. The connection string has no sslmode, ssl_root_cert or tls_min_version keyword either: set those as discrete options or as uri parameters (or use Encrypt / TrustServerCertificate). The integrated-auth keywords (Integrated Security, Trusted_Connection, Authenticator, Krb5 …) parse but lead to a refused connection; Authentication=ActiveDirectory… is rejected as not implemented.

---

Connection URI

The standard ADBC uri option takes a URL:

<scheme>://[user[:password]@]host[:port][/database][?key=value&…]

• Schemes (case-insensitive, equivalent): netezza://, and postgresql:// / postgres://. The scheme only selects the URL grammar; it never picks the driver. The older arpenz:// is still accepted.
• The path segment is the database name.
• userinfo, host, path and query values are percent-decoded; query values treat + as a space. Bracketed IPv6 hosts use [::1]:5480. A single host only.
• For the ADO.NET key=value; form, use connection_string, not uri.

Query parameters (names are case-insensitive). An unknown parameter is rejected, and so is a parameter for a field already given (e.g. ?dbname= with a /database path). Host and port come from the authority part only.

Parameter	Option
user	username
password	password
dbname	database
application_name	application_name
connect_timeout	login_timeout
sslmode	sslmode
sslrootcert	ssl_root_cert
require_password_encryption	require_password_encryption
channel_binding, gssencmode, krbsrvname	accepted; no effect on Netezza (require refused)

netezza://admin:<pw>@nzhost:5480/SYSTEM?sslmode=verify-full&sslrootcert=/etc/nz/ca.pem
netezza://admin:<pw>@nzhost/SYSTEM?sslmode=disable

tls_min_version has no uri parameter: set it as a discrete option.

Options with no connection-string or URI form

Some options cannot be set from both strings:

Option	Where it can be set besides a discrete option
tls_min_version, socket_timeout, query_timeout, buffer_size, interval_type, char_encoding, json_extension, ingest_method, arpeio.adbc.license, arpeio.adbc.license_file	nowhere: discrete option only
sslmode, ssl_root_cert	uri parameter only (no connection-string keyword)
encrypt, trust_server_cert	connection-string keyword only (no uri parameter)

---

See also

• Authentication: password, TLS, what is not supported
• Data types: Netezza → Arrow type mapping
• Compatibility: supported NPS versions
• Troubleshooting: common connection failures
• Examples: copy-paste recipes
• Licensing: supplying your Arpeio licence