Skip to main content

FAQ Masking (KBA4130)




KBA# 4130

What are the invalid characters in a Connector Name (or other names)?

This invalid characters in a Connector Name (version 5.3) are: 

'~', '!', '@', '#', '$', '%', '^', '&', '*', '(', ')', '"', '?', ':', ';', ',', '/', '\', '`', '+', '=', '[', ']', '{', '}', '|', '<', '>' and '

How much Job Memory is needed? 

The amount of Job Memory needed is dependent on a few things.

Please see this page for more information: Memory - How Much and Errors (KBA1036).

How much Masking Engine memory is needed?

The amount of Masking Engine Memory needed is dependent on how many jobs are running and the amount of memory these are using. To get the amount use this formula to estimate.

Engine memory needed: 
  • On the engine: 4 GB (OS etc) + max "per job" x "number of jobs concurrently".




If you don't have enough memory on the engine - the engine will crash.




  • More memory might be needed for the OS etc if the engine has been configured with more memory.
  • It is important to not overcommit resources on the VM server. All Delphix servers should have enough resources. 


More information can be found here: Memory - How Much and Errors (KBA1036).

How to configure the Masking Connector with an AD account?

The example below is how to use Active Directory (AD) on MS SQL Server. AD Accounts can be used on other databases as well. 



Do not use Basic Connector and don't use the format: "<DomainName>\<UserName>".

MS SQL Server

To use an Active Directory (AD) account on MS SQL Server follow these steps:

  1. Ensure a regular local SQLserver user, eg. "delphixmasking" shows as SQLserver authentication under SSMS and successfully tests with Delphix connector.
  2. On Windows SSMS: Check the AD account permissions:
    • Will need to add access to the specific DB desired.
    • The default MSSQL jtds JDBC connector string needs to add the domain=AD (use your DomainName) parameter.
  3. On Masking Engine: Configure a Masking Connector using Advanced option.
    • Use the advanced connector to be able to pass this parameter; sample string looks like: 
    • jdbc:jtds:sqlserver://;domain=AD

Related Articles: 

Is authentication using AD Groups supported?

Authentication using AD Groups is not supported and there are no plans to support AD Groups as this is seen as a security risk.

How to edit masked field/column?

To change the masked field/column, use the Edit icon (green pen). Depending on the change do the following:  

  1. Changing unmasked > masked:
    • Click the Edit icon (green pen).
    • Select Domain - and if needed alter the Algorithm
    • Click Save.
  2. Changing masked - alter Domain/Algorithm:
    • Click the Edit icon (green pen).
    • Select and alter Domain* - alternatively alter the Algorithm
    • Click Save.
  3. Changing masked > unmasked:
    • Click the Edit icon (green pen).
    • Click Domain and set this to Choose Domain.
    • Click Save.


To change and define Domains go to Settings > Domain in the UI.  

What is a Domain? 

The term Domain pops up in a few places on the Masking Engine.

For example: 

  • In 'Settings'.
  • When using 'Profiling'
  • On the page 'Rule Set Inventory' configuration.

The Domain feature is used to group algorithms used in both Masking and Tokenization into one entity. As Masking and Tokenization go hand in hand, a parent group has been created so algorithm allocation in the Inventory and the Profiler can assign Masking and Tokenization algorithms at the same time.

a. Domain > 1. Masking algorithm 
          > 2. Tokenization algorithm

When selecting a Domain - both these algorithms are set at the same time.

Related Articles