Connect application identity to database access ​

External directory login and Coordinator DB authentication are separate tasks. The documented server accepts explicitly configured usernames and passwords, with optional HTTP Bearer API keys. It does not document directory authentication, group-to-role mapping or database roles.

When an application authenticates people through an external identity system, have it decide which reader tasks each person may perform. The application then connects to Coordinator DB with credentials configured for that service and executes the permitted SQL. Do not send an external access token to the database and assume it is a configured API key.

For operational visibility, the query log records the authenticated database username and interface. That username represents the database credential used by the application; it is not automatically the original person's directory identity. Keep any additional audit correlation in the application's own access records without placing sensitive tokens in SQL.

Review network reachability and secure transport separately. Coordinator DB has no built-in TLS listener. Explicit credentials, external login and encrypted connectivity answer different questions and must each be configured where needed.

See authentication, user declarations, HTTP credentials and query history.