This page provides a guide to Establishing a Connection to MySQL in CData Cloud, as well as information on the available resources, and a reference to the available connection properties.

Connecting to MySQL

Establishing a Connection shows how to authenticate to MySQL and configure any necessary connection properties to create a database in CData Cloud

Accessing Data from CData Cloud Services

Accessing data from MySQL through the available standard services and CData Cloud administration is documented in further details in the CData Cloud Documentation.

Connect to MySQL by selecting the corresponding icon in the Database tab. Required properties are listed under Settings. The Advanced tab lists connection properties that are not typically required.

Connecting to MySQL

To connect to MySQL data, set the following properties:

• Server: The host name or IP of the server hosting the MySQL database.
• Port: The port of the server hosting the MySQL database.
• Database (optional): The default database to connect to when connecting to the MySQL Server. If this is not set, MySQL returns tables from all available databases.

Authenticating to MySQL

MySQL supports the following types of authentication:

• Standard
• NT Lan Manager (NTLM)
• LDAP
• SSL
• SSH
• Azure
• AWS

Standard Authentication

To authenticate using standard authentication, set AuthScheme to Password and set the following properties:

• User: The username of the authenticating MySQL user.
• Password: The password associated with the authenticating MySQL user.

NTLM

To authenticate using NTLM, set AuthScheme to NTLM.

By default, the Cloud determines user credentials and the NTLM domain automatically, using either the domain of the PC it is running on or the domain used by the machine running the MySQL instance. To discover the user credentials, the Cloud reads the current NTLM user.

If you want to specify a different domain, provide different login credentials, or change the target NTLM version via any or all of the following optional properties:

• User: The authenticating NTLM user.
• Password: The authenticating NTLM user's password.
• Domain: The name of the domain you want to connect to.
• NTLMVersion: The NTLM version used by the Cloud. Legal values are 1 (default) and 2.

LDAP

To authenticate as an LDAP user, set AuthScheme to LDAP.

Your LDAP credentials are auto-detected by default. If you want to designate a different user and account, set the following optional properties:

• User: The user to login as.
• Password: The user's password.

SSL

To leverage SSL authentication to connect securely to MySQL data, set these properties:

• SSLClientCert: The name of the certificate store for the client certificate. Used in the case of 2-way SSL, where truststore and keystore are kept on both the client and server machines.
• SSLClientCertPassword: The client certificate store's password. Required if the certificate store is password-protected.
• SSLClientCertSubject: The subject of the TLS/SSL client certificate. Used to locate the certificate in the store.
• SSLClientCertType:; The certificate type of the client store.
• SSLServerCert: The certificate to be accepted from the server.

SSH

To authenticate to a remote machine via SSH and access MySQL data, set these properties:

• SSHClientCert: The name of the certificate store for the client certificate.
• SSHClientCertPassword: If a client certificate store is password-protected, set this value to the store's password.
• SSHClientCertSubject: The subject of the TLS/SSL client certificate. Used to locate the certificate in the store.
• SSHClientCertType: The certificate type of the client store.
• SSHPassword: The password that you use to authenticate with the SSH server.
• SSHPort: The port used for SSH operations.
• SSHServer: The SSH authentication server you are trying to authenticate against.
• SSHServerFingerPrint: The SSH Server fingerprint used to verify the host you are connecting to.
• SSHUser: The username for authenticating to the SSH server.

MySQL on Azure

You can authenticate to a MySQL database hosted on Azure AD as an Azure AD user (using Azure AD user credentials), using Azure MSI (using a Managed Service Identity), or via an Azure Password. The following table describes required connection parameters for all three authschemes.

	Parameter	Set To...	Notes
Azure AD user	AzureTenant	The Microsoft Online tenant where MySQL is located.	See Note 1.
	AuthScheme	AzureAD	See Note 2.
Azure MSI	AzureTenant	The Microsoft Online tenant where MySQL is located.	See Note 1.
	AuthScheme	AzureMSI	Most often used when MySQL is running on an Azure VM.
	OAuthClientId	Managed identity's client_identity	Required to obtain a token for a managed identity or if the VM has multiple user-assigned managed identities.
Azure Password	AuthScheme	AzurePassword	To connect directly using your Azure credentials, specify the User and Password of the account you use to connect to Azure.

Notes

1. AzureTenant is generally supplied in the form companyname.microsoft.com, but it is also acceptable to specify the tenant Id. (The tenant Id is the same as the directory Id shown in the Azure Portal Azure Active Directory > Properties page.)
2. The AzureAD AuthScheme is generally used with a custom OAuth application to establish the required OAuth credentials. These usually take the form of an account identifier or cllient ID, and the account password or client secret.

MySQL on AWS

You can connect to a MySQL database hosted on AWS using either IAM roles or EC2 roles.

AWS IAM Roles

To authenticate through AWS, set AuthScheme to AwsIAMRoles.

To authenticate as an AWS role, set these properties:

• User: The database user to authenticate as.
• AWSAccessKey: The access key of the IAM user to assume the role for.
• AWSSecretKey: The secret key of the IAM user to assume the role for.
• AWSRoleARN: Specify the Role ARN for the role you'd like to authenticate with. This will cause the Cloud to attempt to retrieve credentials for the specified role.

If multi-factor authentication is required, specify the following:

• CredentialsLocation: The location of the settings file where MFA credentials are saved. See the Credentials File Location page under Connection String Options for more information.
• MFASerialNumber: The serial number of the MFA device if one is being used.
• MFAToken: The temporary token available from your MFA device.

This causes the Cloud to submit the MFA credentials in the request to retrieve temporary authentication credentials.

Note: If you want to control the duration of the temporary credentials, set the TemporaryTokenDuration property (default: 3600 seconds).

Note: In some circumstances it might be preferable to use an IAM role for authentication, rather than the direct security credentials of an AWS root user. If you are specifying the AWSAccessKey and AWSSecretKey of an AWS root user, you cannot use roles.

Using AWS From an EC2 Instance

Set AuthScheme to AwsEC2Roles.

If you are using the Cloud from an EC2 Instance and have an IAM Role assigned to the instance, you can use the IAM Role to authenticate. Since the Cloud automatically obtains your IAM Role credentials and authenticates with them, it is not necessary to specify AWSAccessKey and AWSSecretKey.

• User: The database user to authenticate as.
• AWSRoleARN: Optional. By default the Cloud authenticates as the default IAM role assigned to the EC2 instance. If you set this option, the Cloud first authenticates as the default instance role and then assumes this role.

IMDSv2 Support

The MySQL Cloud now supports IMDSv2. Unlike IMDSv1, the new version requires an authentication token. Endpoints and response are the same in both versions.

In IMDSv2, the MySQL Cloud first attempts to retrieve the IMDSv2 metadata token and then uses it to call AWS metadata endpoints. If it is unable to retrieve the token, the Cloud reverts to IMDSv1.

Customizing the SSL Configuration

By default, the Cloud attempts to negotiate TLS with the server. The server certificate is validated against the default system trusted certificate store. You can override how the certificate gets validated using the SSLServerCert connection property.

To specify another certificate, see the SSLServerCert connection property.

Client SSL Certificates

The MySQL Cloud also supports setting client certificates. Set the following to connect using a client certificate.

• SSLClientCert: The name of the certificate store for the client certificate.
• SSLClientCertType: The type of key store containing the TLS/SSL client certificate.
• SSLClientCertPassword: The password for the TLS/SSL client certificate.
• SSLClientCertSubject: The subject of the TLS/SSL client certificate.

Connecting Through a Firewall or Proxy

Set the following properties:

• To use a proxy-based firewall, set FirewallType, FirewallServer, and FirewallPort.
• To tunnel the connection, set FirewallType to TUNNEL.
• To authenticate, specify FirewallUser and FirewallPassword.
• To authenticate to a SOCKS proxy, additionally set FirewallType to SOCKS5.

The connection string properties are the various options that can be used to establish a connection. This section provides a complete list of the options you can configure in the connection string for this provider. Click the links for further details.

For more information on establishing a connection, see Establishing a Connection.

Authentication

---

Property	Description
AuthScheme	Specifies the authentication scheme used to connect to the data source. This determines how the user or application credentials are validated. Choose an option supported by your MySQL server database.
Server	Specifies the host name or IP address of the MySQL server to connect to. This property supports both single-server and clustered environments through comma-separated values.
Port	Specifies the port number used to connect to the MySQL server. This property supports both single-node and clustered environments. For clusters, you may specify a comma-separated list of ports that correspond to each server in the Server property.
User	Specifies the authenticating user's user ID.
Password	Specifies the authenticating user's password.
Database	Specifies the name of the MySQL database to connect to by default. This determines the active schema used for queries unless explicitly overridden.
Domain	Specifies the Windows domain name to use when the AuthScheme is NTLM, which enables Windows Integrated Authentication using the NTLM protocol. This value is required if the user account belongs to a domain other than the local machine or default network domain.
NTLMVersion	Specifies the version of the NTLM protocol to use when authenticating with Windows credentials. This setting is only applicable when AuthScheme=NTLM.
IntegratedUser	Specifies the Windows user account to be used when authenticating with NTLM. This value is only applicable when AuthScheme=NTLM and is used to explicitly identify the integrated user for domain-based authentication.
UseSSL	This property determines whether Secure Sockets Layer (SSL) is enabled for communication. By default, SSL is set to 'false', meaning that communications are not encrypted unless explicitly enabled.

AWS Authentication

---

Property	Description
AWSAccessKey	Specifies your AWS account access key. This value is accessible from your AWS security credentials page.
AWSSecretKey	Your AWS account secret key. This value is accessible from your AWS security credentials page.
AWSRoleARN	The Amazon Resource Name of the role to use when authenticating.

Azure Authentication

---

Property	Description
AzureTenant	Identifies the MySQL tenant being used to access data. Accepts either the tenant's domain name (for example, contoso.onmicrosoft.com ) or its directory (tenant) ID.

OAuth

---

Property	Description
OAuthClientId	Specifies the client ID (also known as the consumer key) assigned to your custom OAuth application. This ID is required to identify the application to the OAuth authorization server during authentication.
OAuthClientSecret	Specifies the client secret assigned to your custom OAuth application. This confidential value is used to authenticate the application to the OAuth authorization server. (Custom OAuth applications only.).
Scope	Specifies the scope of the authenticating user's access to the application, to ensure they get appropriate access to data. If a custom OAuth application is needed, this is generally specified at the time the application is created.

SSL

---

Property	Description
SSLServerCert	Specifies the certificate to be accepted from the server when connecting using TLS/SSL.

SSH

---

Property	Description
SSHAuthMode	The authentication method used when establishing an SSH Tunnel to the service.
SSHClientCert	A certificate to be used for authenticating the SSHUser.
SSHClientCertPassword	The password of the SSHClientCert key if it has one.
SSHClientCertSubject	The subject of the SSH client certificate.
SSHClientCertType	The type of SSHClientCert private key.
SSHServer	The SSH server.
SSHPort	The SSH port.
SSHUser	The SSH user.
SSHPassword	The SSH password.
SSHServerFingerprint	The SSH server fingerprint.
UseSSH	Whether to tunnel the MySQL connection over SSH. Use SSH.

Logging

---

Property	Description
Verbosity	Specifies the verbosity level of the log file, which controls the amount of detail logged. Supported values range from 1 to 5.

Schema

---

Property	Description
BrowsableSchemas	Optional setting that restricts the schemas reported to a subset of all available schemas. For example, BrowsableSchemas=SchemaA,SchemaB,SchemaC .

Miscellaneous

---

Property	Description
AllowUserVariables	Specifies whether user-defined variables (prefixed with @) are allowed in SQL queries. When enabled, the driver treats these as in-query user variables instead of parameter placeholders, allowing advanced SQL scripting patterns, such as variable assignment and conditional logic.
Characterset	Specifies the default client character set used by the provider for encoding queries it sends to the server.
DateTimeTimeZone	Specifies the timezone to apply to DATETIME types.
EnsureKeepAlive	Setting this property to 'true' means that provider pings the server before performing a request, so the driver knows if the connection has been dropped since the last request.
MaxRows	Specifies the maximum number of rows returned for queries that do not include either aggregation or GROUP BY.
ServerTimeZone	Specifies the timezone identifier for the MySQL server, based on the current edition and platform. This setting controls how the driver interprets and converts datetime values between the server and client.
Timeout	This setting defines how long (in seconds) an operation is allowed to run before the system automatically considers it as having timed out. If the operation does not finish within the specified time, a timeout error is thrown. The default value is set to 30 seconds.
TinyInt1Type	Defines the presentation type used to display small integer values.
ZeroDatesToNull	This property determines whether Date and DateTime values consisting entirely of zeros (for example, '0000-00-00' or '0000-00-00 00:00:00') are returned as NULL values. By default, this property is set to 'true', meaning any invalid date or datetime values represented as all zeros is returned as NULL instead of their original value.

This section provides a complete list of the Authentication properties you can configure in the connection string for this provider.

---

Property	Description
AuthScheme	Specifies the authentication scheme used to connect to the data source. This determines how the user or application credentials are validated. Choose an option supported by your MySQL server database.
Server	Specifies the host name or IP address of the MySQL server to connect to. This property supports both single-server and clustered environments through comma-separated values.
Port	Specifies the port number used to connect to the MySQL server. This property supports both single-node and clustered environments. For clusters, you may specify a comma-separated list of ports that correspond to each server in the Server property.
User	Specifies the authenticating user's user ID.
Password	Specifies the authenticating user's password.
Database	Specifies the name of the MySQL database to connect to by default. This determines the active schema used for queries unless explicitly overridden.
Domain	Specifies the Windows domain name to use when the AuthScheme is NTLM, which enables Windows Integrated Authentication using the NTLM protocol. This value is required if the user account belongs to a domain other than the local machine or default network domain.
NTLMVersion	Specifies the version of the NTLM protocol to use when authenticating with Windows credentials. This setting is only applicable when AuthScheme=NTLM.
IntegratedUser	Specifies the Windows user account to be used when authenticating with NTLM. This value is only applicable when AuthScheme=NTLM and is used to explicitly identify the integrated user for domain-based authentication.
UseSSL	This property determines whether Secure Sockets Layer (SSL) is enabled for communication. By default, SSL is set to 'false', meaning that communications are not encrypted unless explicitly enabled.

Specifies the authentication scheme used to connect to the data source. This determines how the user or application credentials are validated. Choose an option supported by your MySQL server database.

Possible Values

Password, AzureAD, AzurePassword, LDAP

Data Type

string

Default Value

"Password"

Remarks

This property controls how authentication is performed. The following authentication schemes are supported:

• Password: Basic authentication using a username and password. This is the default and most widely supported method.
• NTLM: Windows-integrated authentication for environments that use Active Directory.
• AzureAD: Authenticates using Azure Active Directory's device code or interactive flow. Suitable for client-side applications without needing a username/password.
• AzurePassword: Authenticates with Azure AD using a username and password (requires app registration with proper permissions).
• AzureMSI: Uses Azure Managed Identity (MSI) for authentication, allowing applications running in Azure (for example, VMs or App Services) to authenticate without secrets. Requires platform support.
• AwsIAMRoles: Authenticates via AWS IAM Role assumption using configured credentials or profiles. Suitable for secure, temporary access within AWS environments.
• AwsEC2Roles: Automatically uses the IAM role assigned to an EC2 instance for authentication. Ideal for serverless and cloud-native applications.
• LDAP: Authenticates against an LDAP server using standard LDAP credentials (username/password). Often used in enterprise environments.

Specifies the host name or IP address of the MySQL server to connect to. This property supports both single-server and clustered environments through comma-separated values.

Data Type

string

Default Value

""

Remarks

This property defines the network location of the MySQL instance. This can be either a fully qualified domain name (FQDN) such as mysql.example.com or an IP address like 192.168.0.1. It is required for all connections and is essential for identifying the MySQL host the client interacts with.

Multiple host addresses can be provided as a comma-separated list to support high availability or load-balanced MySQL clusters. Each server listed should correspond to a matching port (if different) in the Port property.

Examples:

• Single server: Server="mysql.example.com"
• Multiple servers: Server="192.168.0.1,192.168.0.2"

Note: Ensure the specified server(s) are reachable over the network and the MySQL service is running and accepting connections on the corresponding port(s).

Specifies the port number used to connect to the MySQL server. This property supports both single-node and clustered environments. For clusters, you may specify a comma-separated list of ports that correspond to each server in the Server property.

Data Type

string

Default Value

"3306"

Remarks

This property defines the network port used to establish a connection to the MySQL database server. By default, MySQL uses port 3306.

If connecting to a high-availability or clustered setup, you may specify multiple ports as a comma-separated list. Each port should match the corresponding entry in the Server list.

Examples:

• Single server: Port="3306"
• Cluster: Port="3306,3307,3308" (matches Server="db1,db2,db3")

Note: If the port does not match the server’s configuration, the connection may fail. Ensure that the specified ports are open and reachable on the target hosts.

Specifies the authenticating user's user ID.

Data Type

string

Default Value

""

Remarks

The authenticating server requires both User and Password to validate the user's identity.

Specifies the authenticating user's password.

Data Type

string

Default Value

""

Remarks

The authenticating server requires both User and Password to validate the user's identity.

Specifies the name of the MySQL database to connect to by default. This determines the active schema used for queries unless explicitly overridden.

Data Type

string

Default Value

""

Remarks

This property defines the default database (schema) that the Cloud connects to when establishing a connection to the MySQL Server. Set this property to limit the connection to a specific database, which can improve performance, simplify metadata discovery, and reduce accidental cross-database access.

If set, all queries operate within the context of the specified database. If not set, the Cloud exposes tables and views from all accessible databases on the server.

Example:

Database = "inventory"

Note: In shared environments with multiple databases, explicitly setting the Database is recommended to avoid ambiguity and ensure consistent behavior across applications.

Specifies the Windows domain name to use when the AuthScheme is NTLM, which enables Windows Integrated Authentication using the NTLM protocol. This value is required if the user account belongs to a domain other than the local machine or default network domain.

Data Type

string

Default Value

""

Remarks

By default, the Cloud uses the domain of the local machine it is running on or, if applicable, the domain of the machine hosting the MySQL instance.

Use this property to explicitly specify a different domain if you are connecting to a remote server under a different Active Directory domain, or if you want to override the default behavior for testing or deployment.

Example:

Domain = "CORPDOMAIN"

Note: Ensure that the user credentials provided (via the User and Password properties) are valid for the specified domain. Failure to do so may result in authentication errors.

Specifies the version of the NTLM protocol to use when authenticating with Windows credentials. This setting is only applicable when AuthScheme=NTLM.

Possible Values

1, 2

Data Type

string

Default Value

"1"

Remarks

This property allows you to control which version of the NTLM authentication protocol is used. Two versions are supported:

• 1 – NTLMv1: The original version of the NTLM protocol. It offers basic authentication support but is generally considered less secure.
• 2 – NTLMv2: A more secure and widely recommended version that includes enhanced session security and cryptographic protection.

The default value is 1 (NTLMv1).

Set this property to 2 to comply with modern security policies and Active Directory environments that require NTLMv2. Use 1 only if you are connecting to legacy systems that do not support NTLMv2.

Note: Some domain controllers may reject NTLMv1 requests due to security policy restrictions. If authentication fails with version 1, try setting NTLMVersion=2.

Specifies the Windows user account to be used when authenticating with NTLM. This value is only applicable when AuthScheme=NTLM and is used to explicitly identify the integrated user for domain-based authentication.

Data Type

string

Default Value

""

Remarks

This property sets the user identity that the Cloud uses when performing Windows (NTLM) authentication. It can be used to explicitly set a user for NTLM authentication when the default Windows identity should not be used. It can also be used when running applications or services under a different Windows user context than the host process.

You may specify the user as DOMAIN\\Username or Username (if the Domain property is set separately).

Example:

IntegratedUser = "CORP\\jdoe"

Note: This property is optional. If not set, the system attempts to use the current Windows user context (the user running the process or service). It is used in conjunction with the Domain and Password properties when performing NTLM login.

This property determines whether Secure Sockets Layer (SSL) is enabled for communication. By default, SSL is set to 'false', meaning that communications are not encrypted unless explicitly enabled.

Data Type

bool

Default Value

false

Remarks

This property specifies whether the Cloud attempts to establish secure connections using TLS/SSL when communicating with a server. When enabled (set to 'true'), the system initiates a TLS/SSL handshake to negotiate a secure communication channel.

• Default Behavior: If SSL is not enabled, the communication occurs without encryption, and no SSL/TLS handshake takes place.
• Trusted Certificates: When SSL is enabled, the Cloud verifies the server’s certificate against the system’s trusted certificate store. This ensures that the server is trusted and that the connection is secure.
• Custom Certificates: To use a custom server certificate (rather than relying on the system's trusted store), you can set this property to 'true' and then specify the certificate by setting the SSLServerCert property.

This section provides a complete list of the AWS Authentication properties you can configure in the connection string for this provider.

---

Property	Description
AWSAccessKey	Specifies your AWS account access key. This value is accessible from your AWS security credentials page.
AWSSecretKey	Your AWS account secret key. This value is accessible from your AWS security credentials page.
AWSRoleARN	The Amazon Resource Name of the role to use when authenticating.

Specifies your AWS account access key. This value is accessible from your AWS security credentials page.

Data Type

string

Default Value

""

Remarks

To find your AWS account access key:

1. Sign into the AWS Management console with the credentials for your root account.
2. Select your account name or number.
3. Select My Security Credentials in the menu.
4. Click Continue to Security Credentials.
5. To view or manage root account access keys, expand the Access Keys section.

Your AWS account secret key. This value is accessible from your AWS security credentials page.

Data Type

string

Default Value

""

Remarks

Your AWS account secret key. This value is accessible from your AWS security credentials page:

1. Sign into the AWS Management console with the credentials for your root account.
2. Select your account name or number and select My Security Credentials in the menu that is displayed.
3. Click Continue to Security Credentials and expand the Access Keys section to manage or create root account access keys.

The Amazon Resource Name of the role to use when authenticating.

Data Type

string

Default Value

""

Remarks

When authenticating outside of AWS, it is common to use a Role for authentication instead of your direct AWS account credentials. Entering the AWSRoleARN will cause the CData Cloud to perform a role based authentication instead of using the AWSAccessKey and AWSSecretKey directly. The AWSAccessKey and AWSSecretKey must still be specified to perform this authentication. You cannot use the credentials of an AWS root user when setting RoleARN. The AWSAccessKey and AWSSecretKey must be those of an IAM user.

This section provides a complete list of the Azure Authentication properties you can configure in the connection string for this provider.

---

Property	Description
AzureTenant	Identifies the MySQL tenant being used to access data. Accepts either the tenant's domain name (for example, contoso.onmicrosoft.com ) or its directory (tenant) ID.

Identifies the MySQL tenant being used to access data. Accepts either the tenant's domain name (for example, contoso.onmicrosoft.com ) or its directory (tenant) ID.

Data Type

string

Default Value

""

Remarks

A tenant is a digital container for your organization's users and resources, managed through Microsoft Entra ID (formerly Azure AD). Each tenant is associated with a unique directory ID, and often with a custom domain (for example, microsoft.com or contoso.onmicrosoft.com).

To find the directory (tenant) ID in the Microsoft Entra Admin Center, navigate to Microsoft Entra ID > Properties and copy the value labeled "Directory (tenant) ID".

This property is required in the following cases:

• When AuthScheme is set to AzureServicePrincipal or AzureServicePrincipalCert
• When AuthScheme is AzureAD and the user account belongs to multiple tenants

You can provide the tenant value in one of two formats:

• A domain name (for example, contoso.onmicrosoft.com)
• A directory (tenant) ID in GUID format (for example, c9d7b8e4-1234-4f90-bc1a-2a28e0f9e9e0)

Specifying the tenant explicitly ensures that the authentication request is routed to the correct directory, which is especially important when a user belongs to multiple tenants or when using service principal–based authentication.

If this value is omitted when required, authentication may fail or connect to the wrong tenant. This can result in errors such as unauthorized or resource not found.

This section provides a complete list of the OAuth properties you can configure in the connection string for this provider.

---

Property	Description
OAuthClientId	Specifies the client ID (also known as the consumer key) assigned to your custom OAuth application. This ID is required to identify the application to the OAuth authorization server during authentication.
OAuthClientSecret	Specifies the client secret assigned to your custom OAuth application. This confidential value is used to authenticate the application to the OAuth authorization server. (Custom OAuth applications only.).
Scope	Specifies the scope of the authenticating user's access to the application, to ensure they get appropriate access to data. If a custom OAuth application is needed, this is generally specified at the time the application is created.

Specifies the client ID (also known as the consumer key) assigned to your custom OAuth application. This ID is required to identify the application to the OAuth authorization server during authentication.

Data Type

string

Default Value

""

Remarks

This property is required in two cases:

• When using a custom OAuth application, such as in web-based authentication flows, service-based authentication, or certificate-based flows that require application registration.
• If the driver does not provide embedded OAuth credentials.

(When the driver provides embedded OAuth credentials, this value may already be provided by the Cloud and thus not require manual entry.)

OAuthClientId is generally used alongside other OAuth-related properties such as OAuthClientSecret and OAuthSettingsLocation when configuring an authenticated connection.

OAuthClientId is one of the key connection parameters that need to be set before users can authenticate via OAuth. You can usually find this value in your identity provider’s application registration settings. Look for a field labeled Client ID, Application ID, or Consumer Key.

While the client ID is not considered a confidential value like a client secret, it is still part of your application's identity and should be handled carefully. Avoid exposing it in public repositories or shared configuration files.

For more information on how this property is used when configuring a connection, see Establishing a Connection.

Specifies the client secret assigned to your custom OAuth application. This confidential value is used to authenticate the application to the OAuth authorization server. (Custom OAuth applications only.).

Data Type

string

Default Value

""

Remarks

This property (sometimes called the application secret or consumer secret) is required when using a custom OAuth application in any flow that requires secure client authentication, such as web-based OAuth, service-based connections, or certificate-based authorization flows. It is not required when using an embedded OAuth application.

The client secret is used during the token exchange step of the OAuth flow, when the driver requests an access token from the authorization server. If this value is missing or incorrect, authentication fails with either an invalid_client or an unauthorized_client error.

OAuthClientSecret is one of the key connection parameters that need to be set before users can authenticate via OAuth. You can obtain this value from your identity provider when registering the OAuth application.

Notes:

• This value should be stored securely and never exposed in public repositories, scripts, or unsecured environments.
• Client secrets may also expire after a set period. Be sure to monitor expiration dates and rotate secrets as needed to maintain uninterrupted access.

For more information on how this property is used when configuring a connection, see Establishing a Connection

Specifies the scope of the authenticating user's access to the application, to ensure they get appropriate access to data. If a custom OAuth application is needed, this is generally specified at the time the application is created.

Data Type

string

Default Value

""

Remarks

Scopes are set to define what kind of access the authenticating user will have; for example, read, read and write, restricted access to sensitive information. System administrators can use scopes to selectively enable access by functionality or security clearance.

When InitiateOAuth is set to GETANDREFRESH, you must use this property if you want to change which scopes are requested.

When InitiateOAuth is set to either REFRESH or OFF, you can change which scopes are requested using either this property or the Scope input.

This section provides a complete list of the SSL properties you can configure in the connection string for this provider.

---

Property	Description
SSLServerCert	Specifies the certificate to be accepted from the server when connecting using TLS/SSL.

Specifies the certificate to be accepted from the server when connecting using TLS/SSL.

Data Type

string

Default Value

""

Remarks

If you are using a TLS/SSL connection, use this property to specify the TLS/SSL certificate to be accepted from the server. If you specify a value for this property, all other certificates that are not trusted by the machine are rejected.

This property can take the following forms:

Description	Example
A full PEM Certificate (example shortened for brevity)	-----BEGIN CERTIFICATE----- MIIChTCCAe4CAQAwDQYJKoZIhv......Qw== -----END CERTIFICATE-----
A path to a local file containing the certificate	C:\cert.cer
The public key (example shortened for brevity)	-----BEGIN RSA PUBLIC KEY----- MIGfMA0GCSq......AQAB -----END RSA PUBLIC KEY-----
The MD5 Thumbprint (hex values can also be either space- or colon-separated)	ecadbdda5a1529c58a1e9e09828d70e4
The SHA1 Thumbprint (hex values can also be either space- or colon-separated)	34a929226ae0819f2ec14b4a3d904f801cbb150d

Note: It is possible to use '*' to signify that all certificates should be accepted, but due to security concerns this is not recommended.

This section provides a complete list of the SSH properties you can configure in the connection string for this provider.

---

Property	Description
SSHAuthMode	The authentication method used when establishing an SSH Tunnel to the service.
SSHClientCert	A certificate to be used for authenticating the SSHUser.
SSHClientCertPassword	The password of the SSHClientCert key if it has one.
SSHClientCertSubject	The subject of the SSH client certificate.
SSHClientCertType	The type of SSHClientCert private key.
SSHServer	The SSH server.
SSHPort	The SSH port.
SSHUser	The SSH user.
SSHPassword	The SSH password.
SSHServerFingerprint	The SSH server fingerprint.
UseSSH	Whether to tunnel the MySQL connection over SSH. Use SSH.

The authentication method used when establishing an SSH Tunnel to the service.

Possible Values

None, Password, Public_Key

Data Type

string

Default Value

"Password"

Remarks

• None: No authentication is performed. The current SSHUser value is ignored, and the connection is logged in as anonymous.
• Password: The Cloud uses the values of SSHUser and SSHPassword to authenticate the user.
• Public_Key: The Cloud uses the values of SSHUser and SSHClientCert to authenticate the user. SSHClientCert must have a private key available for this authentication method to succeed.

A certificate to be used for authenticating the SSHUser.

Data Type

string

Default Value

""

Remarks

SSHClientCert must contain a valid private key in order to use public key authentication. A public key is optional, if one is not included then the Cloud generates it from the private key. The Cloud sends the public key to the server and the connection is allowed if the user has authorized the public key.

The SSHClientCertType field specifies the type of the key store specified by SSHClientCert. If the store is password protected, specify the password in SSHClientCertPassword.

Some types of key stores are containers which may include multiple keys. By default the Cloud will select the first key in the store, but you can specify a specific key using SSHClientCertSubject.

The password of the SSHClientCert key if it has one.

Data Type

string

Default Value

""

Remarks

This property is required for SSH tunneling when using certificate-based authentication. If the SSH certificate is in a password-protected key store, provide the password using this property to access the certificate.

The subject of the SSH client certificate.

Data Type

string

Default Value

"*"

Remarks

When loading a certificate the subject is used to locate the certificate in the store.

If an exact match is not found, the store is searched for subjects containing the value of the property.

If a match is still not found, the property is set to an empty string, and no certificate is selected.

The special value "*" picks the first certificate in the certificate store.

The certificate subject is a comma separated list of distinguished name fields and values. For instance "CN=www.server.com, OU=test, C=US, [email protected]". Common fields and their meanings are displayed below.

Field	Meaning
CN	Common Name. This is commonly a host name like www.server.com.
O	Organization
OU	Organizational Unit
L	Locality
S	State
C	Country
E	Email Address

If a field value contains a comma it must be quoted.

The type of SSHClientCert private key.

Possible Values

PFXBLOB, JKSBLOB, PEMKEY_BLOB, PPKBLOB, XMLBLOB

Data Type

string

Default Value

"PEMKEY_BLOB"

Remarks

This property can take one of the following values:

Types	Description	Allowed Blob Values
MACHINE/USER		Blob values are not supported.
JKSFILE/JKSBLOB		base64-only
PFXFILE/PFXBLOB	A PKCS12-format (.pfx) file. Must contain both a certificate and a private key.	base64-only
PEMKEY_FILE/PEMKEY_BLOB	A PEM-format file. Must contain an RSA, DSA, or OPENSSH private key. Can optionally contain a certificate matching the private key.	base64 or plain text.
PPKFILE/PPKBLOB	A PuTTY-format private key created using the puttygen tool.	base64-only
XMLFILE/XMLBLOB	An XML key in the format generated by the .NET RSA class: RSA.ToXmlString(true).	base64 or plain text.

The SSH server.

Data Type

string

Default Value

""

Remarks

The SSH server.

The SSH port.

Data Type

string

Default Value

"22"

Remarks

The SSH port.

The SSH user.

Data Type

string

Default Value

""

Remarks

The SSH user.

The SSH password.

Data Type

string

Default Value

""

Remarks

The SSH password.

The SSH server fingerprint.

Data Type

string

Default Value

""

Remarks

The SSH server fingerprint.

Whether to tunnel the MySQL connection over SSH. Use SSH.

Data Type

bool

Default Value

false

Remarks

By default the Cloud will attempt to connect directly to MySQL. When this option is enabled, the Cloud will instead establish an SSH connection with the SSHServer and tunnel the connection to MySQL through it.

This section provides a complete list of the Logging properties you can configure in the connection string for this provider.

---

Property	Description
Verbosity	Specifies the verbosity level of the log file, which controls the amount of detail logged. Supported values range from 1 to 5.

Specifies the verbosity level of the log file, which controls the amount of detail logged. Supported values range from 1 to 5.

Data Type

string

Default Value

"1"

Remarks

This property defines the level of detail the Cloud includes in the log file. Higher verbosity levels increase the detail of the logged information, but may also result in larger log files and slower performance due to the additional data being captured.

The default verbosity level is 1, which is recommended for regular operation. Higher verbosity levels are primarily intended for debugging purposes. For more information on each level, refer to Logging.

When combined with the LogModules property, Verbosity can refine logging to specific categories of information.

This section provides a complete list of the Schema properties you can configure in the connection string for this provider.

---

Property	Description
BrowsableSchemas	Optional setting that restricts the schemas reported to a subset of all available schemas. For example, BrowsableSchemas=SchemaA,SchemaB,SchemaC .

Optional setting that restricts the schemas reported to a subset of all available schemas. For example, BrowsableSchemas=SchemaA,SchemaB,SchemaC .

Data Type

string

Default Value

""

Remarks

Listing all available database schemas can take extra time, thus degrading performance. Providing a list of schemas in the connection string saves time and improves performance.

This section provides a complete list of the Miscellaneous properties you can configure in the connection string for this provider.

---

Property	Description
AllowUserVariables	Specifies whether user-defined variables (prefixed with @) are allowed in SQL queries. When enabled, the driver treats these as in-query user variables instead of parameter placeholders, allowing advanced SQL scripting patterns, such as variable assignment and conditional logic.
Characterset	Specifies the default client character set used by the provider for encoding queries it sends to the server.
DateTimeTimeZone	Specifies the timezone to apply to DATETIME types.
EnsureKeepAlive	Setting this property to 'true' means that provider pings the server before performing a request, so the driver knows if the connection has been dropped since the last request.
MaxRows	Specifies the maximum number of rows returned for queries that do not include either aggregation or GROUP BY.
ServerTimeZone	Specifies the timezone identifier for the MySQL server, based on the current edition and platform. This setting controls how the driver interprets and converts datetime values between the server and client.
Timeout	This setting defines how long (in seconds) an operation is allowed to run before the system automatically considers it as having timed out. If the operation does not finish within the specified time, a timeout error is thrown. The default value is set to 30 seconds.
TinyInt1Type	Defines the presentation type used to display small integer values.
ZeroDatesToNull	This property determines whether Date and DateTime values consisting entirely of zeros (for example, '0000-00-00' or '0000-00-00 00:00:00') are returned as NULL values. By default, this property is set to 'true', meaning any invalid date or datetime values represented as all zeros is returned as NULL instead of their original value.

Specifies whether user-defined variables (prefixed with @) are allowed in SQL queries. When enabled, the driver treats these as in-query user variables instead of parameter placeholders, allowing advanced SQL scripting patterns, such as variable assignment and conditional logic.

Data Type

bool

Default Value

false

Remarks

When set to 'true', the Cloud allows the use of user variables in SQL queries. User variables are prefixed by @ and can be declared and modified within the query itself, enabling more dynamic and script-like SQL execution.

Example:

SET @amount = 1000;  
SELECT * FROM Invoices WHERE Total > @amount;

By default ('false'), the driver interprets any value prefixed with @ as a parameter marker to be replaced by external parameter values. This is more suitable for parameterized queries executed via application code.

Enable this property if:

• You are writing multi-statement SQL scripts
• You want to reuse calculated values within a single SQL session
• You are executing logic that benefits from in-query variable assignments

Note: Some SQL engines or data providers may not support user variables. Enabling this option may lead to errors if the underlying service does not allow variable declarations.

Specifies the default client character set used by the provider for encoding queries it sends to the server.

Data Type

string

Default Value

""

Remarks

By default, the Cloud processes queries as Unicode. If you set this property to another value, you may lose the ability to use some characters.

In most cases, you should keep the default setting.

Specifies the timezone to apply to DATETIME types.

Data Type

string

Default Value

"SERVER"

Remarks

By default the Cloud treats TIMESTAMP and DATETIME types the same. The ServerTimeZone property determines what the Cloud does when it encounters either of these types. It can be set to the following values (see its documentation for how to reference specific timezones):

• LOCAL. This disables timezone conversions and returns the value as the server sent it.
• A specific timezone. This assumes all DATETIME and TIMESTAMP values are in that timezone.
• If not set, the Cloud treats all DATETIME and TIMESTAMP values as being in the sesion timezone.

It is also possible to treat DATETIME and TIMESTAMP values differently. For example, you may want DATETIME to be a "wall clock time" that is not subject to timezones, while keeping the zoned behavior for TIMESTAMP. DateTimeTimeZone option lets you configure a separate behavior that applies only to the DATETIME type. It can be set to the following options:

• LOCAL. Like ServerTimeZone, this disables timezone conversions but only for DATETIME.
• A specific timezone. Like ServerTimeZone, this assumes all DATETIME values are in that timezone.
• SERVER. The default, this treats DATETIME values the same way as TIMESTAMP values. ServerTimeZone controls the behavior for both types.

Note: The Cloud does not apply this value to DATETIME values set using prepared statement parameters. If you are using a platform timestamp type (such as java.sql.Timestamp or System.DateTime), the Cloud always adjusts the timezone of the input value to match the ServerTimeZone option.

Setting this property to 'true' means that provider pings the server before performing a request, so the driver knows if the connection has been dropped since the last request.

Data Type

bool

Default Value

false

Remarks

EnsureKeepAlive=true improves error reporting. The user receives a clean error message for connection drops instead of ambiguous socket errors or timeouts that happen later in the process.

The default value is 'false': the Cloud does not ping the server before performing a request.

Specifies the maximum number of rows returned for queries that do not include either aggregation or GROUP BY.

Data Type

int

Default Value

-1

Remarks

The default value for this property, -1, means that no row limit is enforced unless the query explicitly includes a LIMIT clause. (When a query includes a LIMIT clause, the value specified in the query takes precedence over the MaxRows setting.)

Setting MaxRows to a whole number greater than 0 ensures that queries do not return excessively large result sets by default.

This property is useful for optimizing performance and preventing excessive resource consumption when executing queries that could otherwise return very large datasets.

Specifies the timezone identifier for the MySQL server, based on the current edition and platform. This setting controls how the driver interprets and converts datetime values between the server and client.

Data Type

string

Default Value

""

Remarks

Use this property to explicitly define the time zone of the MySQL server. This ensures correct handling of datetime fields, especially when the server and client are in different time zones.

The allowed inputs for this property are both edition-specific and platform-specific. Only Windows+.NET uses Windows timezone IDs, for example, "Pacific Standard Time" or "W. Europe Standard Time". Java and .NET on non-Windows machines use IANA timezone IDs, for example, "America/Los_Angeles" or "Asia/Shanghai".

Set this property to LOCAL, or leave blank, if the server and client are in the same timezone. In this case, no timezone conversion is applied.

This setting defines how long (in seconds) an operation is allowed to run before the system automatically considers it as having timed out. If the operation does not finish within the specified time, a timeout error is thrown. The default value is set to 30 seconds.

Data Type

int

Default Value

30

Remarks

If the timeout value is set to 0, there is no timeout applied to the operation. This means the operation continues running indefinitely until one of two things happens: either the operation successfully completes, or the operation encounters an error.

Defines the presentation type used to display small integer values.

Possible Values

TINYINT, BIT, BOOLEAN

Data Type

string

Default Value

"TINYINT"

Remarks

Set this property to one of the following display types:

• TINYINT: This type is reported as a number.
• BIT: This type is reported as '0' or '1'. All non-zero values are treated as '1'.
• BOOLEAN: This type is reported as 'false' or 'true'. All non-zero values are treated as 'true'.

This property determines whether Date and DateTime values consisting entirely of zeros (for example, '0000-00-00' or '0000-00-00 00:00:00') are returned as NULL values. By default, this property is set to 'true', meaning any invalid date or datetime values represented as all zeros is returned as NULL instead of their original value.

Data Type

bool

Default Value

true

Remarks

This property addresses how MySQL handles invalid Date or DateTime values, where a value of all zeros (for example, '0000-00-00' or '0000-00-00 00:00:00') is considered invalid. Retrieving such a value can result in parsing errors or unexpected behavior unless this property is set to 'true', in which case the system returns NULL instead.

If set to 'false', the system returns the original value of the invalid Date or DateTime as it is, which may cause parsing errors or inconsistencies during further processing.

LZMA from 7Zip LZMA SDK

LZMA SDK is placed in the public domain.

Anyone is free to copy, modify, publish, use, compile, sell, or distribute the original LZMA SDK code, either in source code form or as a compiled binary, for any purpose, commercial or non-commercial, and by any means.

LZMA2 from XZ SDK

Version 1.9 and older are in the public domain.

Xamarin.Forms

Xamarin SDK

The MIT License (MIT)

Copyright (c) .NET Foundation Contributors

All rights reserved.

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

NSIS 3.10

Copyright (C) 1999-2025 Contributors THE ACCOMPANYING PROGRAM IS PROVIDED UNDER THE TERMS OF THIS COMMON PUBLIC LICENSE ("AGREEMENT"). ANY USE, REPRODUCTION OR DISTRIBUTION OF THE PROGRAM CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS AGREEMENT.

1. DEFINITIONS

"Contribution" means:

a) in the case of the initial Contributor, the initial code and documentation distributed under this Agreement, and b) in the case of each subsequent Contributor:

i) changes to the Program, and

ii) additions to the Program;

where such changes and/or additions to the Program originate from and are distributed by that particular Contributor. A Contribution 'originates' from a Contributor if it was added to the Program by such Contributor itself or anyone acting on such Contributor's behalf. Contributions do not include additions to the Program which: (i) are separate modules of software distributed in conjunction with the Program under their own license agreement, and (ii) are not derivative works of the Program.

"Contributor" means any person or entity that distributes the Program.

"Licensed Patents " mean patent claims licensable by a Contributor which are necessarily infringed by the use or sale of its Contribution alone or when combined with the Program.

"Program" means the Contributions distributed in accordance with this Agreement.

"Recipient" means anyone who receives the Program under this Agreement, including all Contributors.

2. GRANT OF RIGHTS

a) Subject to the terms of this Agreement, each Contributor hereby grants Recipient a non-exclusive, worldwide, royalty-free copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, distribute and sublicense the Contribution of such Contributor, if any, and such derivative works, in source code and object code form.

b) Subject to the terms of this Agreement, each Contributor hereby grants Recipient a non-exclusive, worldwide, royalty-free patent license under Licensed Patents to make, use, sell, offer to sell, import and otherwise transfer the Contribution of such Contributor, if any, in source code and object code form. This patent license shall apply to the combination of the Contribution and the Program if, at the time the Contribution is added by the Contributor, such addition of the Contribution causes such combination to be covered by the Licensed Patents. The patent license shall not apply to any other combinations which include the Contribution. No hardware per se is licensed hereunder.

c) Recipient understands that although each Contributor grants the licenses to its Contributions set forth herein, no assurances are provided by any Contributor that the Program does not infringe the patent or other intellectual property rights of any other entity. Each Contributor disclaims any liability to Recipient for claims brought by any other entity based on infringement of intellectual property rights or otherwise. As a condition to exercising the rights and licenses granted hereunder, each Recipient hereby assumes sole responsibility to secure any other intellectual property rights needed, if any. For example, if a third party patent license is required to allow Recipient to distribute the Program, it is Recipient's responsibility to acquire that license before distributing the Program.

d) Each Contributor represents that to its knowledge it has sufficient copyright rights in its Contribution, if any, to grant the copyright license set forth in this Agreement.

3. REQUIREMENTS

A Contributor may choose to distribute the Program in object code form under its own license agreement, provided that:

a) it complies with the terms and conditions of this Agreement; and

b) its license agreement:

i) effectively disclaims on behalf of all Contributors all warranties and conditions, express and implied, including warranties or conditions of title and non-infringement, and implied warranties or conditions of merchantability and fitness for a particular purpose;

ii) effectively excludes on behalf of all Contributors all liability for damages, including direct, indirect, special, incidental and consequential damages, such as lost profits;

iii) states that any provisions which differ from this Agreement are offered by that Contributor alone and not by any other party; and

iv) states that source code for the Program is available from such Contributor, and informs licensees how to obtain it in a reasonable manner on or through a medium customarily used for software exchange.

When the Program is made available in source code form:

a) it must be made available under this Agreement; and

b) a copy of this Agreement must be included with each copy of the Program.

Contributors may not remove or alter any copyright notices contained within the Program.

Each Contributor must identify itself as the originator of its Contribution, if any, in a manner that reasonably allows subsequent Recipients to identify the originator of the Contribution.

4. COMMERCIAL DISTRIBUTION

Commercial distributors of software may accept certain responsibilities with respect to end users, business partners and the like. While this license is intended to facilitate the commercial use of the Program, the Contributor who includes the Program in a commercial product offering should do so in a manner which does not create potential liability for other Contributors. Therefore, if a Contributor includes the Program in a commercial product offering, such Contributor ("Commercial Contributor") hereby agrees to defend and indemnify every other Contributor ("Indemnified Contributor") against any losses, damages and costs (collectively "Losses") arising from claims, lawsuits and other legal actions brought by a third party against the Indemnified Contributor to the extent caused by the acts or omissions of such Commercial Contributor in connection with its distribution of the Program in a commercial product offering. The obligations in this section do not apply to any claims or Losses relating to any actual or alleged intellectual property infringement. In order to qualify, an Indemnified Contributor must: a) promptly notify the Commercial Contributor in writing of such claim, and b) allow the Commercial Contributor to control, and cooperate with the Commercial Contributor in, the defense and any related settlement negotiations. The Indemnified Contributor may participate in any such claim at its own expense.

For example, a Contributor might include the Program in a commercial product offering, Product X. That Contributor is then a Commercial Contributor. If that Commercial Contributor then makes performance claims, or offers warranties related to Product X, those performance claims and warranties are such Commercial Contributor's responsibility alone. Under this section, the Commercial Contributor would have to defend claims against the other Contributors related to those performance claims and warranties, and if a court requires any other Contributor to pay any damages as a result, the Commercial Contributor must pay those damages.

5. NO WARRANTY

EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, THE PROGRAM IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OR CONDITIONS OF TITLE, NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Each Recipient is solely responsible for determining the appropriateness of using and distributing the Program and assumes all risks associated with its exercise of rights under this Agreement, including but not limited to the risks and costs of program errors, compliance with applicable laws, damage to or loss of data, programs or equipment, and unavailability or interruption of operations.

6. DISCLAIMER OF LIABILITY

EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, NEITHER RECIPIENT NOR ANY CONTRIBUTORS SHALL HAVE ANY LIABILITY FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING WITHOUT LIMITATION LOST PROFITS), HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OR DISTRIBUTION OF THE PROGRAM OR THE EXERCISE OF ANY RIGHTS GRANTED HEREUNDER, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

7. GENERAL

If any provision of this Agreement is invalid or unenforceable under applicable law, it shall not affect the validity or enforceability of the remainder of the terms of this Agreement, and without further action by the parties hereto, such provision shall be reformed to the minimum extent necessary to make such provision valid and enforceable.

If Recipient institutes patent litigation against a Contributor with respect to a patent applicable to software (including a cross-claim or counterclaim in a lawsuit), then any patent licenses granted by that Contributor to such Recipient under this Agreement shall terminate as of the date such litigation is filed. In addition, if Recipient institutes patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Program itself (excluding combinations of the Program with other software or hardware) infringes such Recipient's patent(s), then such Recipient's rights granted under Section 2(b) shall terminate as of the date such litigation is filed.

All Recipient's rights under this Agreement shall terminate if it fails to comply with any of the material terms or conditions of this Agreement and does not cure such failure in a reasonable period of time after becoming aware of such noncompliance. If all Recipient's rights under this Agreement terminate, Recipient agrees to cease use and distribution of the Program as soon as reasonably practicable. However, Recipient's obligations under this Agreement and any licenses granted by Recipient relating to the Program shall continue and survive.

Everyone is permitted to copy and distribute copies of this Agreement, but in order to avoid inconsistency the Agreement is copyrighted and may only be modified in the following manner. The Agreement Steward reserves the right to publish new versions (including revisions) of this Agreement from time to time. No one other than the Agreement Steward has the right to modify this Agreement. IBM is the initial Agreement Steward. IBM may assign the responsibility to serve as the Agreement Steward to a suitable separate entity. Each new version of the Agreement will be given a distinguishing version number. The Program (including Contributions) may always be distributed subject to the version of the Agreement under which it was received. In addition, after a new version of the Agreement is published, Contributor may elect to distribute the Program (including its Contributions) under the new version. Except as expressly stated in Sections 2(a) and 2(b) above, Recipient receives no rights or licenses to the intellectual property of any Contributor under this Agreement, whether expressly, by implication, estoppel or otherwise. All rights in the Program not expressly granted under this Agreement are reserved.

This Agreement is governed by the laws of the State of New York and the intellectual property laws of the United States of America. No party to this Agreement will bring a legal action under this Agreement more than one year after the cause of action arose. Each party waives its rights to a jury trial in any resulting litigation.