Querying private databases

All database query steps execute in the mabl cloud, regardless of whether they are sent from the Trainer or during local or cloud execution. If you’re training a test that makes calls to an internal database that isn’t accessible from the public Internet, you can access your database by using mabl Link or by adding mabl static IP addresses to an allowlist.

This article outlines three different ways to connect to a private database, and what to check when a connection fails:

• Add a Link Agent override to the database connection
• Use a Link-enabled environment
• Add mabl static IP addresses to an allowlist
• If the connection fails

Add a Link Agent override

When configuring a database connection, you can add an explicit Link Agent override:

1. Set up a Link Agent on a host in your network. Make sure the Link Agent host has access to the private database.
2. When configuring the database connection, select the Link Agent from the mabl Link Agent override dropdown. The dropdown lists your workspace's tunnels and any company-scoped tunnels.

When you train and run tests that contain queries to this database, the queries connect to the private database through the configured Link Agent override.

Use a Link-enabled environment

Alternatively, you can connect to the database through a Link-enabled environment:

1. Set up a Link Agent on a host in your network. Make sure the Link Agent host has access to the private database.
2. Associate the Link Agent with the test environment that will make queries to the private database.
3. Associate the test with the Link-enabled environment:
   • If you are training a test with queries to the private database, configure the training session to use the Link-enabled environment.
   • If you are running tests that access the private database, configure the test or plan to run on the Link-enabled environment.

As long as the Link Agent is active and your database queries use an environment associated with that Link Agent, you should be able to access the private database during training and execution.

Add mabl IP addresses to an allowlist

If mabl Link is not an option for your team, you can also give mabl access to a non-public database by adding mabl static IP addresses to an allowlist.

Keep in mind that a firewall rule that admits mabl's IP addresses to your web application doesn't admit them to the database. The database port itself has to accept connections from mabl's ranges, which is a change many security teams don't allow. For that reason, teams that already use mabl Link for browser tests usually use it for database queries as well. Choosing between mabl Link and static IP allowlisting compares the two options.

If the connection fails

Click Test connection on the database connection to check it. If the check fails or the query editor can't reach the database, work through these in order.

Is the connection routed through your Link Agent? A connected agent only carries queries that are routed to it. Check that the connection has a Link Agent override, or that the test or training session uses a Link-enabled environment.

Is the hostname localhost or an internal name? Those only resolve from inside your network, so the mabl cloud can't reach them. The database is private: set up a Link Agent on a machine in that network and point the connection's override at it. Over Link, localhost means the Link Agent's own machine, so it only works when the agent runs on the database host. Otherwise, use the database's internal hostname.

Is the database Microsoft SQL Server in Azure? Set the connection policy to Proxy. See the note in Database connections.

Can the Link Agent's host reach the database? Run a TCP connect check against the database's host and port through the tunnel. See Testing and diagnosing Link connections. For other agent-side problems, see Troubleshooting issues with mabl Link.