---
updatedAt: 2026-03-30T22:06:41.000Z
---

# Add databases to Password Safe | PS On-prem

There are two ways to discover and manage database instances:

* Auto-discover using a scan template, and then auto-manage using a Smart Group. Use this method for SQL Server and Oracle.
* Manually add and manage databases. Use this method for MongoDB, MySQL, Sybase ASE, and Teradata.

## Auto discover and manage database instances

1. Open a browser and enter the URL for your Password Safe instance: **https\://\<hostname>/WebConsole/index.html**.
2. Enter your username and password.
3. From the left menu, click ![](https://files.readme.io/bdb02c35ba2303e590077ff55e7ad9560a6c7be669fe6593838210ab93b6e091-smart-rules.png).\
   The **Smart Rules** page displays.
4. Click **+ Create Smart Rule**.

   ![Create new Smart Rule](https://files.readme.io/a45c8798cfd7e878c33f32c5249e6b56c1defbafea35fe84d3503b9b3db3fa2b-image.png)
5. Select a **Category**.
6. Enter a **Name** and **Description**.
7. Under **Selection Criteria**, select **Address Group**.
8. Select the group that includes the database instances.
9. Click **Add another condition**.
10. Select **Host Database Instance**.
11. Select the database types.
12. Under **Actions**, select **Show asset as Smart Group**.
13. Click **Add another action**.
14. Select **Manage Assets using Password Safe**.
15. Select the platforms, account name formats, functional accounts, and other desired settings.
16. Use the default port numbers for the databases:
    * Oracle: **1521**
    * SQL Server: **1433**
17. Click **Create Smart Rule**.

> ℹ️
>
> * An Oracle database can be part of a database cluster. If several nodes are found through discovery, only a single database managed system is created. Cluster fail over is supported.
> * The Smart Rule auto-excludes the functional account assigned for that system, as well as the **sa** account for MS SQL Server systems, from Password Safe onboarding. The **sa** account is excluded as a precaution against it being inadvertently onboarded by mistake. If you want Password Safe to manage the **sa** account, you can either manually create the managed account or use the **Create Managed Account on each system** Smart Rule action in a Managed System Based Smart Rule.
> * To view the contents of a Smart Rule when creating a new rule or editing an existing rule:
>   * Once the rule is saved, click **View Results**.
>   * You are taken to the associated grid, where the contents of the Smart Rule are listed.
>   * If the rule is actively processing, a banner displays with that information.
> * **View Results** displays only if you have permissions to the grid corresponding to the Smart Rule, i.e.; Assets, Managed Accounts, Managed Systems.
> * The Smart Rule must be saved with **Show \<entity> as Smart Group** selected under **Actions** to view the results.
> * Because the Smart Rule must process to display the contents in the grid, we recommend viewing the results using only the **Show \<entity> as Smart Group** action and before adding additional actions that may make changes to accounts and assets in your network. Once you have confirmed the rule contains your desired items, you can then add additional actions to the Smart Rule.

### Manually add database instances

You can manually add the following database instance types. When selecting the database platform, ensure the correct port number is displayed.

* Mongo: **27017**
* MS SQL Server: **1433**
* MySQL: **3306**
* Oracle: **1521**
* PostgreSQL: **5432**
* SAP HANA: **30015**
* Sybase ASE: **5000**
* Teradata: **1025**

#### Manually add databases to assets managed by Password Safe

1. From the left menu, click ![Assets icon](https://files.readme.io/1517585e4da36c1eab818c9916a2ce004d8ae7b9ca4b8e0d3f0c45f65998681c-assets.png).\
   The **Assets** page displays.
2. Locate the asset in the grid.
3. Click ![Ellipsis icon](https://files.readme.io/6510db312bf2b69a8e3e5467df7161eb719d09832984ab66f99a928f94d4c54c-ellipsis.png) **> Go to Advanced Details**.
4. In the **General Data** pane, select **Databases**.
5. Click **+ Add Database** above the grid.
6. Provide a name, select the platform, add a version, and leave the default port.
7. Click **Save Database**.

#### Manually add databases to Password Safe management

1. From the left menu, click ![Assets icon](https://files.readme.io/1517585e4da36c1eab818c9916a2ce004d8ae7b9ca4b8e0d3f0c45f65998681c-assets.png).\
   The **Assets** page displays.
2. Locate the asset in the grid.  Assets that host database instances are indicated by a **Database Host** icon in the **Solution** column.
3. Click ![Ellipsis icon](https://files.readme.io/6510db312bf2b69a8e3e5467df7161eb719d09832984ab66f99a928f94d4c54c-ellipsis.png) **> Go to Advanced Details**.
4. In the **General Data** pane, select **Databases**.
5. Locate the instance in the grid.
6. Click ![Ellipsis icon](https://files.readme.io/6510db312bf2b69a8e3e5467df7161eb719d09832984ab66f99a928f94d4c54c-ellipsis.png) **> Add to Password Safe**.
7. On the **Create New Managed System** form, expand **Credentials**.
8. Select the functional account.
9. Select other settings as required.
10. Click **Create Managed System**.

### Manage database instance accounts

Once the database instances are managed, create a managed accounts Smart Rule to manage the database instance accounts. The steps are the same for both auto-discovered or manually added database instances.

1. From the left menu, click ![Smart Rules icon](https://files.readme.io/bdb02c35ba2303e590077ff55e7ad9560a6c7be669fe6593838210ab93b6e091-smart-rules.png).\
   The **Smart Rules** page displays.

2. From the **Smart Rule Type filter** dropdown, select **Managed Account**.

3. Click **+ Create Smart Rule**.

4. From the **Category** dropdown, select **Managed Accounts**.

5. Enter a **Name** and **Description**.

6. Select the criteria to match on the database instance account name, filtering out any named functional accounts.

7. Select **Yes** from the **Discover accounts for Password Safe Management** list.

8. From the **Discover accounts from** list, select the smart group where the database instance resides.

9. Under **Actions** section, select **Show managed account as a Smart Group** from the list.

10. Click **Add another action**.

11. Select **Manage Account Settings** from the list.

12. Select a password rule, and either auto-manage the accounts or do not.

13. Click **Create Smart Rule**.

> ℹ️
>
> * An Oracle database can be part of a database cluster. If several nodes are found through discovery, only a single database managed system is created. Cluster fail over is supported.
> * The Smart Rule auto-excludes the functional account assigned for that system, as well as the **sa** account for MS SQL Server systems, from Password Safe onboarding. The **sa** account is excluded as a precaution against it being inadvertently onboarded by mistake. If you want Password Safe to manage the **sa** account, you can either manually create the managed account or use the **Create Managed Account on each system** Smart Rule action in a Managed System Based Smart Rule.
> * To view the contents of a Smart Rule when creating a new rule or editing an existing rule:
>   * Once the rule is saved, click **View Results**.
>   * You are taken to the associated grid, where the contents of the Smart Rule are listed.
>   * If the rule is actively processing, a banner displays with that information.
> * **View Results** displays only if you have permissions to the grid corresponding to the Smart Rule, i.e.; Assets, Managed Accounts, Managed Systems.
> * The Smart Rule must be saved with **Show \<entity> as Smart Group** selected under **Actions** to view the results.
> * Because the Smart Rule must process to display the contents in the grid, we recommend viewing the results using only the **Show \<entity> as Smart Group** action and before adding additional actions that may make changes to accounts and assets in your network. Once you have confirmed the rule contains your desired items, you can then add additional actions to the Smart Rule.

### Discover accounts for SAP HANA databases

Most database platforms leverage the Discovery Scanner to discover the asset and then find the accounts in the database . SAP HANA, however, does not use the Discovery Scanner. With the SAP HANA database platform, you must manually create the asset and then leverage a managed account Smart Rule for account discovery.

When creating the managed account Smart Rule, select the following under **Selection Criteria**:

* **User Account Attribute** from the first dropdown list.
* **Account Name** from the second list.
* The appropriate operator from the third list, i.e. contains, equals (=), starts with, etc.
* Enter the appropriate value in the next field.
* **Yes** from the **Discover Accounts for** Password Safe **Management** dropdown list.
* An existing asset Smart Group that contains the SAP HANA asset(s) in your environment, from the **Discover Accounts From** dropdown list.

## Create a functional account for SQL Server

When you are adding SQL Server as a managed system, you must first create a security login in SQL Server to use for the functional account.

### Permissions and roles in SQL Server

The following roles and permissions are required in SQL for the functional account:

* Server roles – public
* ALTER ANY LOGIN
* CONNECT SQL

> ℹ️
>
> Per [Microsoft](https://learn.microsoft.com/en-us/sql/relational-databases/security/sql-server-security-best-practices?view=sql-server-ver16#password-risks), it is considered best practice to disable the SA account for security purposes. However, if the SA account is not disabled, rotating the password regularly increases security. The functional account must have **sysadmin** privileges to rotate passwords for accounts that have sysadmin privileges.

### Apply permissions to a functional account:

The following code samples show you how to apply the required permissions to the functional account.

```
GRANT CONNECT SQL TO [FunctionalAccountName];
```

```
GRANT ALTER ANY LOGIN TO [FunctionalAccountName];
```

### Create the account in SQL Server

1. Connect to a database as the SQL Server **sa** on the asset you manage.
2. Expand **Security** and expand **Logins**.
3. Right-click **Logins** and select **New login**.
4. Enter a **Login name** and select **SQL Server Authorization**.
5. Enter and confirm a password.
6. Configure the user as desired and click **OK**.
7. To configure the user, right-click the user and select **Properties**.
8. Select **Server Roles** and ensure the public roles is selected.
9. Select **Securables** and click **Search**.
10. Select the server instance and click **OK**.
11. From the list of permissions, ensure the **Alter any login** and **Connect SQL** are selected for **Grantor sa**.
12. Click **OK**.

## Retrieve SQL Server instance port

To configure a SQL Server database for Password Safe, you must retrieve the port number on the managed database instance using a query. The below query is required for database instances only. You do not need to provide a port number for the default instance.

1. Create an instance on SQL Server.
2. Once the instance is running, open the database and then select **New Query**.
3. Execute the following query as shown on separate lines:
   ```
   GO
   xp_readerrorlog 0, 1, N'Server is listening on'
   GO
   ```
4. From the left menu, click ![Assets icon](https://files.readme.io/1517585e4da36c1eab818c9916a2ce004d8ae7b9ca4b8e0d3f0c45f65998681c-assets.png).\
   The **Assets** page displays.
5. Locate the asset in the grid where the SQL Server database is installed.
6. Click ![Ellipsis icon](https://files.readme.io/6510db312bf2b69a8e3e5467df7161eb719d09832984ab66f99a928f94d4c54c-ellipsis.png) **> Go to Advanced Details**.
7. Under **General Data**, click **Databases**.
8. Click **+ Add Database** above the grid.
9. Enter a name for the instance.
10. Select **MS SQL Server** from the **Platform** dropdown.
11. Leave the default port or manually add the correct database port.
12. Click **Save Database**.
13. From the **Databases** grid, click ![Ellipsis icon](https://files.readme.io/6510db312bf2b69a8e3e5467df7161eb719d09832984ab66f99a928f94d4c54c-ellipsis.png) **> Add to Password Safe**.
14. Select the details required for the managed system.
15. Click **Create Managed System**.

## Add a PostgreSQL database instance

A PostgreSQL database instance must be added manually.

Before adding the instance to Password Safe management, you must create an account in PostgreSQL to use as the functional account in Password Safe.

### Create accounts in PostgreSQL

> ℹ️
>
> The following instructions are for guidance only. For details on how to create an account, refer to the PostgreSQL documentation.

To create the account with appropriate level permissions:

1. Run **pgadmin** from the icon on the tray.
2. Right-click **Login/Group** roles, and then click **Create**.
3. Enter a name. This is the functional account.
4. On the **Privileges** tab, ensure the following permissions are in place for the functional account: **Login**, **Create role**, and **Inherit rights from parent roles**.
5. Right-click **Login/Group** roles, and then select **Create**.
6. Enter a name. This is the managed account.
7. On the **Privileges** tab, ensure the following permissions are in place for the managed account: **Login**, and **Inherit rights from parent roles**.

You must also know the database instance name and the port number. In **pgadmin**, click **Object** , select **Properties**, and then click the **Connection** tab.

### Add the PostgreSQL instance to Password Safe

1. Scan the asset where the PostgreSQL instance resides.
2. From the left menu, click ![Assets icon](https://files.readme.io/1517585e4da36c1eab818c9916a2ce004d8ae7b9ca4b8e0d3f0c45f65998681c-assets.png).\
   The **Assets** page displays.
3. Click ![Ellipsis icon](https://files.readme.io/6510db312bf2b69a8e3e5467df7161eb719d09832984ab66f99a928f94d4c54c-ellipsis.png) **> Go to Advanced Details**.
4. Under **General Data**, click **Databases**.
5. Click the vertical ellipsis button for the desired instance, and then select **Add to** Password Safe.
6. Set the following:
   * **Instance Name:** Enter the instance name.
   * **Platform:** Select **PostgreSQL**.
   * **Version:** Enter the PostgreSQL version number. This is optional.
   * **Port:** The default port value is **5432**.
7. Click **Create Managed System**.

## Configure settings on the Oracle platform

When adding Oracle as a managed system, follow these steps:

* Add the functional account to the console.
* Add the functional account to the Oracle user list in Oracle.
* Set the IP address for the host in Oracle Net Manager.

### Add the functional account

1. From the left menu, click ![Configuration icon](https://files.readme.io/5440329f4c22243ec1f8721a1c3d821fa7d6b7468cd0904e01869dc74e6cf354-configuration.png).\
   The **Configuration** page displays.
2. Under **Privileged Access Management**,  select **Functional Accounts**.\
   The **Functional Accounts** page displays.
3. Click **Create New Functional Account**.
4. Select **Database** from the **Entity Type** dropdown.
5. Select **Oracle** from the **Platform** dropdown.
6. Select **SYSDBA** from the **Search Privileges** dropdown.
7. Enter the username and password. The SYSDBA role is required if you use the SYS Oracle account as the functional account.
8. Set the remaining options as required.
9. Click **Create Functional Account**.

> ℹ️
>
> When adding the Oracle platform as a managed system, be sure to select the SYSDBA functional account.

### Set permissions for the functional account in Oracle

In Oracle Enterprise Manager, the functional account (other than SYS) must be added to the Oracle user list.

The user account must be assigned the following **Privileges & Roles**:

* ALTER USER
* CONNECT
* SELECT ON DBA\_USERS (Required for auto Discovery of Oracle instance managed accounts.)

### Create the functional account in Oracle

To create a functional account in Oracle:

```
CREATE USER [FunctionalAccountName] IDENTIFIED BY password;
    GRANT CONNECT TO [FunctionalAccountName];
```

To grant permission to the functional account to change passwords on a managed account:

```
GRANT CONNECT TO [FunctionalAccountName];
    GRANT ALTER USER TO [FunctionalAccountName];
    GRANT SELECT ON DBA_USERS TO [FunctionalAccountName];
```

### Configure the host

On the Oracle platform, you must configure the following settings:

* In Oracle Net Manager, the host name IP address must be explicitly set as a listener.
* Also in Oracle Net Manager, set the service name as the host name IP address.

### Use encrypted connections

Password Safe supports Oracle database connections that are configured to use encryption. Using encryption is optional.

The following encryption protocols are supported:

* AES128
* AES192
* AES256
* RC4\_128, RC4\_256, 3DES112
* 3DES168

Configure encryption using Oracle Net Manager.

> ℹ️
>
> The following section is provided for guidance only. For more information, refer to Oracle product documentation.

On the **Profile** node, select **Network Security** and then set the following:

* On the **Integrity** tab, select:
  * **Server** from the **Integrity** menu
  * **required** from the **Checksum Level** menu
  * **SHA256** as the method
* On the **Encryption** tab, select:
  * **Server** from the **Encryption** menu
  * **required** from the **Encryption Type** menu
  * **AES256** as the method

> ℹ️
>
> If you select **required** for **Checksum Level** and **Encryption Type**, you must enter an encryption seed in the **sqlnet.ora** file.

### Oracle internet directories (OID)

OID Connect Descriptors (also known as TNS Connect Strings) define all parameters needed to connect to a specific Oracle database service, such as the instance name, DNS name, IP address, and port. You can leverage OID Connect Descriptors to add Oracle database systems to Password Safe.

When adding an Oracle database as a Managed System in Password Safe, select the appropriate database service and Password Safe reads the Connect Descriptor data when communicating with the Oracle database.

### Configure an Oracle internet directory

To use this functionality, you must configure an OID:

1. From the left menu, click ![Configuration icon](https://files.readme.io/5440329f4c22243ec1f8721a1c3d821fa7d6b7468cd0904e01869dc74e6cf354-configuration.png).\
   The **Configuration** page displays.
2. Under **Privileged Access Management**,  select **Oracle Internet Directories**.\
   The **Oracle Internet Directories** page displays.
3. Click **Create New Oracle Internet Directory +**.
4. Enter a name for the directory, a short description, and information for the LDAP server.
5. Check **Use SSL** if required.
6. If you turn off **Use Anonymous**, enter a name and password.
7. Click **Create Directory**.
8. You can also click **Test Server** to test the connection.