Connect a supplier to Database Gateway

A supplier needs to read or write data through WKL Database Gateway, without access to the rest of your network and without database credentials.

You put a TLS adapter in front of the gateway as its only entry point, and your relationship policy admits exactly the supplier services that should reach the gateway. The gateway takes the verified partner identity from the adapter and authorizes every operation by the rule of the alias for that identity. On the supplier's side, the application talks to its local TLS adapter.

At the customer

1. Agree on a trust relationship with the supplier, as described in Federation and bilateral trust.
2. In your relationship policy, list as services the supplier systems that should reach the gateway, and as purpose the data access through the gateway.
3. Put the TLS adapter in front of the gateway and register it in the gateway as a trusted proxy under TrustedProxies. The gateway then adopts the partner identity only from the adapter.
4. Use the network or the host firewall to make the gateway reachable from the adapter only. Otherwise anyone could write the identity headers themselves.
5. In the gateway, create an alias rule for the partner identity: which tables and views, which operations, which rows.

At the supplier

1. Point the application at the local TLS adapter, as if the gateway were on the same host or in the supplier's own network. That holds for in-house applications over HTTP and OData as well as for Microsoft Access, Excel, or Power BI through the WKL OData ODBC Driver or the gateway client.
2. TrustBridge manages certificates and keys on the host; the application needs neither.

Result. Every request passes the customer's TLS adapter, which checks the chain, namespace, revocation status, and relationship policy. The gateway runs only what the alias rule allows and logs the operation with the partner identity. The TLS adapter logs the connection setup.

• Whether the supplier's VPN goes away depends on what else it's used for. For data access through the gateway, the supplier doesn't need access to the rest of your network.
• The operator protects the legs between TLS adapter and gateway and between gateway and database under its own rules.
• How the gateway's rules, aliases, and sign-in methods work is described in the Database Gateway documentation.
• End the access by revoking the relationship, not by disabling individual accounts.

• Connecting the Database Gateway – how access works in four steps and what changes compared with direct access
• Federation and bilateral trust – a relationship policy per direction
• No new connections to a partner