This section describes how to set up ODBC connectivity and configure DSNs on several Linux distributions: Debian-based systems, like Ubuntu, and Red Hat Linux platforms, like Red Hat Enterprise Linux (RHEL) and Fedora.

Minimum Linux Versions

Here are the minimum supported versions for Red Hat-based and Debian-based systems:

OS	Min. Version
Ubuntu	18.04
Debian	10
RHEL	8
Fedora	28
SUSE	15

Installing the Driver Dependencies

Run the following commands as root or with sudo to install the necessary dependencies:

• Debian/Ubuntu:
  

  apt-get install libc6 libstdc++6 zlib1g libgcc1

• RHEL/Fedora:
  

  yum install glibc libstdc++ zlib libgcc

Installing the Driver

You can use standard package management systems to install the driver.

On Debian-based systems, like Ubuntu, run the following command with root or sudo:

dpkg -i /path/to/driver/setup/D365BusinessCentralODBCDriverforUnix.deb 

On systems that support the RPM package format, run the following command with root or sudo:

rpm -ivh /path/to/driver/D365BusinessCentralODBCDriverforUnix.rpm 

Licensing the Driver

Run the following commands to license the driver. To activate a trial, omit the <key> input.

cd /opt/cdata/cdata-odbc-driver-for-d365businesscentral/bin/
sudo ./install-license.sh <key>

Connecting through the Driver Manager

The driver manager loads the driver and passes function calls from the application to the driver. You need to register the driver with the driver manager and you define DSNs in the driver manager's configuration files.

The driver installation registers the driver with the unixODBC driver manager and creates a system DSN. The unixODBC driver manager can be used from Python and from many other applications. Your application may embed another driver manager.

Creating the DSN

See Using unixODBC to install unixODBC and configure DSNs. See Using the DataDirect Driver Manager to create a DSN to connect to OBIEE, Informatica, and SAS.

Connecting to Microsoft Dynamics 365 Business Central

Cloud Endpoints

To connect to data, specify OrganizationURL, where OrganizationURL is one of the following:

• The endpoint to your business central account, such as https://businesscentral.dynamics.com/abc123/.
• The web services root.
• The custom API base url.

On-Premises Endpoints

The following are examples of on-premises endpoints:

https://base URL:port/serverinstance/api/API publisher/API group/API version/
https://base URL:port//serverinstance/ODataV4  
https://myInstance/.local:7048/BC220/ODataV4

The URL is blocked by default; your administrator must enable access to it.

For information about on how to specify the OrganizationURL and which endpoints are available, see Business Central Endpoints.

If you have multiple companies in your organization, you can specify the Company to identify the company to which you want to connect. If you leave Company blank, the driver retrieves all companies as separate schemas.

User and Access Key

Note: User and Access key Authentication is no longer supported for the Cloud version. Web Service Access Key (Basic authentication) is still supported for on-premisees instances.

Microsoft recommends using User and Access Keys for testing and development, but discourages their use for production environments.

To obtain the User and AccessKey values, navigate to the Users page in Microsoft Dynamics 365 Business Central and then click on Edit. The User Name and Web Service Access Key values are what you will enter as the User and AccessKey connection string properties. Note that the User Name is not your email address. It is a shortened user name.

To use Access Key authentication, set these properties:

• AuthScheme: Access Key
• User: The login username.
• AccessKey: The access key.

Authenticating to Microsoft Dynamics 365 Business Central

Before you can authenticate to the Microsoft Dynamics 365 Business Central source, you must set the OrganizationURL to the URL of the organization you are connecting to. Depending on whether you are using v1 or v2, this could look quite different. For a discussion of the various possible formats for OrganizationURL, see Business Central Endpoints.

You can authenticate to Microsoft Dynamics 365 Business Central in any of the following ways.

Access Key

Set the User along with the AccessKey to authenticate to the Microsoft Dynamics 365 Business Central source.

Entra ID (Azure AD)

Note: Microsoft has rebranded Azure AD as Entra ID. In topics that require the user to interact with the Entra ID Admin site, we use the same names Microsoft does. However, there are still CData connection properties whose names or values reference "Azure AD".

Microsoft Entra ID is a multi-tenant, cloud-based identity and access management platform. It supports OAuth-based authentication flows that enable the driver to access Microsoft Dynamics 365 Business Central endpoints securely.

Authentication to Entra ID via a web application always requires that you first create and register a custom OAuth application. This enables your application to define its own redirect URI, manage credential scope, and comply with organization-specific security policies.

For full instructions on how to create and register a custom OAuth application, see Creating an Entra ID (Azure AD) Application.

After setting AuthScheme to AzureAD, the steps to authenticate vary, depending on the environment. For details on how to connect from desktop applications, web-based workflows, or headless systems, see the following sections.

Desktop Applications

You can authenticate from a desktop application using either the driver's embedded OAuth application or a custom OAuth application registered in Microsoft Entra ID.

Option 1: Use the Embedded OAuth Application

This is a pre-registered application, included with the driver. It simplifies setup and eliminates the need to register your own credentials and is ideal for development environments, single-user tools, or any setup where quick and easy authentication is preferred.

Set the following connection properties:

• AuthScheme: AzureAD
• InitiateOAuth:
  • GETANDREFRESH – Use for the initial login. Launches the login page and saves tokens.
  • REFRESH – Use this setting when you have already obtained valid access and refresh tokens. Reuses stored tokens without prompting the user again.

When you connect, the driver opens the Microsoft Entra sign-in page in your default browser. After signing in and granting access, the driver retrieves the access and refresh tokens and saves them to the path specified by OAuthSettingsLocation.

Option 2: Use a Custom OAuth Application

If your organization requires more control, such as managing security policies, redirect URIs, or application branding, you can instead register a custom OAuth application in Microsoft Entra ID and provide its values during connection.

During registration, record the following values:

• OAuthClientId: The client Id that was generated when you registered your custom OAuth application.
• OAuthClientSecret: The client secret that was that was generated when you registered your custom OAuth application.
• CallbackURL: A redirect URI you defined during application registration.

For full instructions on how to register a custom OAuth application and configure redirect URIs, see Creating an Entra ID (Azure AD) Application.

Set the following connection properties:

• AuthScheme: AzureAD
• InitiateOAuth:
  • GETANDREFRESH – Use for the initial login. Launches the login page and saves tokens.
  • REFRESH – Use this setting when you have already obtained valid access and refresh tokens. Reuses stored tokens without prompting the user again.
• OAuthClientId: The client Id that was generated when you registered your custom OAuth application.
• OAuthClientSecret: The client secret that was generated when you registered your custom OAuth application.
• CallbackURL: A redirect URI you defined during application registration.

After authentication, tokens are saved to OAuthSettingsLocation. These values persist across sessions and are used to automatically refresh the access token when it expires, so you don't need to log in again on future connections.

Headless Machines

Headless environments like CI/CD pipelines, background services, or server-based integrations do not have an interactive browser. To authenticate using AzureAD, you must complete the OAuth flow on a separate device with a browser and transfer the authentication result to the headless system.

Setup options:

• Obtain and exchange a verifier code
  • Use another device to sign in and retrieve a verifier code, which the headless system uses to request tokens.
• Transfer an OAuth settings file
  • Authenticate on another device, then copy the stored token file to the headless environment.

Using a Verifier Code

1. On a device with a browser:
   • If using a custom OAuth app, set the following properties:
     • OAuthClientId: The client Id that was generated when you registered your custom OAuth application.
     • OAuthClientSecret: The client secret that was generated when you registered your custom OAuth application.
   • Call the GetOAuthAuthorizationUrl stored procedure to generate a sign-in URL.
   • Open the returned URL in a browser. Sign in and grant grant permissions to the driver. You are redirected to the callback URL, which contains the verifier code.
   • After signing in, save the value of the code parameter from the redirect URL. You will use this later to set the OAuthVerifier connection property.
2. On the headless machine:
   • Set the following properties:
     • AuthScheme: AzureAD
     • OAuthVerifier: The verifier code you saved.
     • OAuthSettingsLocation: The path of the file that holds the OAuth token values.
     • For custom applications:
       • OAuthClientId: The client Id that was generated when you registered your custom OAuth application.
       • OAuthClientSecret: The client secret that was generated when you registered your custom OAuth application.
   • After tokens are saved, reuse them by setting:
     • OAuthSettingsLocation: Make sure this location grants read and write permissions to the driver to enable the automatic refreshing of the access token.
     • For custom applications:
       • OAuthClientId: The client Id that was generated when you registered your custom OAuth application.
       • OAuthClientSecret: The client secret that was generated when you registered your custom OAuth application.

Transferring OAuth Settings

1. On a device with a browser:
   • Connect using the instructions in the Desktop Applications section.
   • After connecting, tokens are saved to the file path in OAuthSettingsLocation. The default filename is OAuthSettings.txt.

   Encrypted values are stored in the system registry.

2. On the headless machine:
   • Copy the OAuth settings file to the machine.
   • Set the following properties:
     • AuthScheme: AzureAD
     • OAuthSettingsLocation: Make sure this location grants read and write permissions to the driver to enable the automatic refreshing of the access token.
     • For custom applications:
       • OAuthClientId: The client Id that was generated when you registered your custom OAuth application.
       • OAuthClientSecret: The client secret that was generated when you registered your custom OAuth application.

After setup, the driver uses the stored tokens to refresh the access token automatically, no browser or manual login is required.

Azure Service Principal

Note: Microsoft has rebranded Azure AD as Entra ID. In topics that require the user to interact with the Entra ID Admin site, we use the same names Microsoft does. However, there are still CData connection properties whose names or values reference "Azure AD".

Service principals are security objects within a Microsoft Entra ID (Azure AD) application that define what that application can do within a specific tenant. Service principals are created in the Entra admin center, also accessible through the Azure portal. As part of the creation process we also specify whether the service principal will access Entra resources via a client secret or a certificate.

Depending on the service you are connecting to, a tenant administrator may need to enable Service Principal authentication or assign the Service Principal to the appropriate roles or security groups.

Instead of being tied to a particular user, service principal permissions are based on the roles assigned to them. These roles determine which resources the application can access and which operations it can perform.

When authenticating using a service principal, you must register an application with an Entra tenant, as described in Creating a Service Principal App in Entra ID (Azure AD).

This subsection describes properties you must set before you can connect. These vary, depending on whether you will authenticate via a client secret or a certificate.

Authentication with Client Secret

• AuthScheme: AzureServicePrincipal.
• AzureTenant: The Azure AD tenant to which you will connect.
• OAuthClientId: The client ID in your application settings.
• OAuthClientSecret: The client secret in your application settings.
• InitiateOAuth: GETANDREFRESH. You can use InitiateOAuth to avoid repeating the OAuth exchange and manually setting the OAuthAccessToken.

Authentication with Certificate

• AuthScheme: AzureServicePrincipalCert.
• AzureTenant: The Azure AD tenant to which you will connect.
• OAuthClientId: The client Id in your application settings.
• OAuthJWTCert: The JWT Certificate store.
• OAuthJWTCertType: The JWT Certificate store type.
• InitiateOAuth: GETANDREFRESH. You can use InitiateOAuth to avoid repeating the OAuth exchange and manually setting the OAuthAccessToken.

Managed Service Identity (MSI)

If you are running Microsoft Dynamics 365 Business Central on an Azure VM and want to automatically obtain Managed Service Identity (MSI) credentials to connect, set AuthScheme to AzureMSI.

User-Managed Identities

To obtain a token for a managed identity, use the OAuthClientId property to specify the managed identity's client_id.

If your VM has multiple user-assigned managed identities, you must also specify OAuthClientId.

NTLM

To authenticate using your Windows credentials, Set AuthScheme to NTLM.

Negotiate

To negotiate an authentication mechanism with the server, set AuthScheme to direct driver. Used when authenticating with Kerberos.

Authenticating to Microsoft Dynamics 365 Business Central via Kerberos requires you to define authentication properties and to choose how Kerberos should retrieve authentication tickets.

To authenticate to Microsoft Dynamics 365 Business Central using Kerberos, set these properties:

• hive.server2.authentication: Kerberos.
• AuthScheme: NEGOTIATE.
• KerberosKDC: The host name or IP Address of your Kerberos KDC machine.
• KerberosRealm: The realm of the Microsoft Dynamics 365 Business Central Kerberos principal. Find this value immediately after the '@' symbol of the principal value.
• KerberosSPN: The service and host of the Microsoft Dynamics 365 Business Central Kerberos Principal. Find this value just before the '@' symbol of the principal value.

In addition to the authentication values, set:

• Server: The address of the Microsoft Dynamics 365 Business Central server you are connecting to.
• Platform: The Microsoft Dynamics 365 Business Central version.
• Schema: EWS.A.

Enabling Service-to-Service Authentication

Service-to-Service (S2S) authentication is used when an integration must run on its own, without being tied to any specific user account. S2S authentication uses the OAuth authentication flow with client credentials, rather than OAuth deleted flows, like those used for multifactor authentication (MFA).

To set up service-to-service authentication, you must first register an application in your Azure AD tenant for authenticating API calls against Business Central.

After you have registered the required app in your Azure AD tenant, do the following:

1. In the Business Central client, search for Microsoft Entra applications.
2. Open the page.
3. Select New. The Business Central client opens the Microsoft Entra application card.
4. Enter the Application (Client) ID for the registered application.
5. Complete the Description field. If this application is set up by a partner, be sure to provide enough identifying information so all applications set up by this partner can be tracked in the future if necessary.
6. Set the State to Enabled.
7. Assign permissions to objects as needed. (For further information, see https://learn.microsoft.com/en-us/dynamics365/business-central/ui-define-granular-permissions.)

   Note: The D365 AUTOMATION and EXTEND. MGT. - ADMIN system permissions sets and user groups provide access to most typical objects used with automation. (EXTEND. MGT. - ADMIN replaces the earlier D365 EXTENSION MGT permission set.)

8. (Optional:) If you have not granted consent from the Azure portal before now, select Grant Consent and follow the wizard. Be sure you have already configured a redirect URL in your custom Azure AD application before starting this wizard.

Refreshing OAuth Values

The driver can refresh the temporary OAuth access tokens obtained during the browser-based OAuth authentication exchange. By default, the driver saves the encrypted tokens in the odbc.ini file corresponding to the DSN. Access to this odbc.ini file can be restricted in the case of System DSNs.

To enable the automatic token exchange, you can give the driver write access to the system odbc.ini. Or, you can set the OAuthSettingsLocation connection property to an alternate file path, to which the driver would have read and write access.

    OAuthSettingsLocation=/tmp/oauthsettings.txt
    

Installing Dependencies for OAuth Authentication

The OAuth authentication standard requires the authenticating user to interact with Microsoft Dynamics 365 Business Central, using a web-browser. If the first OAuth interaction is to be done on the same machine the driver is installed on, for example, a desktop application, the driver needs access to the xdg-open program, which opens the default browser.

To satisfy this dependency, install the corresponding package with your package manager:

Debian/Ubuntu Package	RHEL/Fedora Package	File
xdg-utils	xdg-utils	xdg-open

Set the Driver Encoding

The ODBC drivers need to specify which encoding to use with the ODBC Driver Manager. By default, the CData ODBC Drivers for Unix are configured to use UTF-16 which is compatible with unixODBC, but other Driver Managers may require alternative encoding.

Alternatively, if you are using the ODBC driver from an application that uses the ANSI ODBC API it may be necessary to set the ANSI code page. For example, to import Japanese characters in an ANSI application, you can specify the code page in the config file '/opt/cdata/cdata-odbc-driver-for-d365businesscentral/lib/cdata.odbc.d365businesscentral.ini':

[Driver]
AnsiCodePage = 932