Oracle RADIUS (Duo, Okta MFA) sign-in and tnsnames.ora on the Mac
Posted by Kyle Hankinson November 13, 2026
More and more Oracle shops are moving their databases behind RADIUS, with Duo or Okta supplying the second factor. The database stops checking your password itself and hands the sign-in to a RADIUS server, which may send a push to your phone before it lets you in. If your tools do not speak RADIUS, the login fails with ORA-01017 no matter how carefully you type the password, and the usual advice is "use SQL Developer".
SQLPro Studio and SQLPro for Oracle now sign in to Oracle through RADIUS, and on the Mac they can also read your connections straight from tnsnames.ora. Neither needs Oracle Instant Client, Java or a JDBC driver.
RADIUS sign-in
If you have set this up in SQL Developer, you added a property to the connection: oracle.net.authentication_services with the value RADIUS. The setting here is the same idea with a friendlier name.
Open an Oracle connection (a new one or one you already have) and change Authentication from "Database password" to RADIUS (MFA). Enter your login and password as usual and connect.
What happens next depends on how your organization set up the second factor:
- Push notification. The connection waits while Duo or Okta sends the push to your phone. Approve it and the connection opens. The app waits up to two minutes, so there is no rush.
- Passcode. If you use a code from an authenticator app or a hardware token, type it after your password, separated by a comma:
mypassword,123456. This is the convention Duo and most RADIUS servers use. - No prompt at all. Some sites switch the database to RADIUS first and turn the second factor on later. In that case it simply connects.
One sign-in per connection
A database client normally opens several sessions behind your back: one for the sidebar, one per query tab, another for background lookups. With RADIUS each new session is a new login, which would mean a push for every tab you open.
To avoid that, a RADIUS connection shares one signed-in session across the whole window and reuses it for the sidebar, your tabs and everything else. You approve one push when you connect, and that is normally the only one. The exception is when two things truly have to run at the same moment, for example a long query in one tab while you run another in a second tab. The app waits up to ten seconds for the first to finish, and only then opens one more session, which costs one more approval.
Clearer errors
When the RADIUS server turns a sign-in down, Oracle reports the same ORA-01017 it uses for a mistyped password. The app adds a line saying the RADIUS server rejected the sign-in and what to check: the password, the push, or a passcode. A push that nobody approves is reported as a timed-out MFA sign-in instead of a bare network timeout.
Connections from tnsnames.ora
Most Oracle sites keep their connection list in a tnsnames.ora file, often next to a sqlnet.ora, and the DBA team updates it when servers move. Retyping every host, port and service name into another tool is tedious, and it goes stale the first time something changes.
On the Mac you can now point the app at the folder that holds those files:
- Open the connection window and choose New > Oracle > Connections from tnsnames.ora...
- Pick the folder that contains
tnsnames.ora(the one Oracle callsTNS_ADMIN;~/.oracleis a common home for it, and the dialog shows hidden folders). - Give the group a name. It is only a label; every entry in the file is added.
The entries appear as their own group in the connection list, one row per alias.
The file stays in charge
The group is read from the folder every time the connection window opens. When the DBA team adds a database or moves one to a new host, it shows up the next time you open the window, with no import step to repeat. Rows in the group cannot be deleted or re-pointed from inside the app, because the file is the source of truth.
A few details:
sqlnet.orais honored for sign-in. If it containsSQLNET.AUTHENTICATION_SERVICES = (RADIUS), every connection in the group defaults to RADIUS. You can still change it per connection.- Failover lists work. An entry with several addresses tries them in order and skips a dead one after five seconds. A
DESCRIPTION_LISTwith a primary and a standby is tried one description at a time. IFILEincludes are followed, as long as the included file is inside the folder you picked.- Entries the app cannot use are skipped and counted. Local
IPCandBEQentries need an Oracle client on the same machine, so the group title tells you how many were left out instead of failing the whole file.
Your login is still yours
tnsnames.ora is an address book. It says where each database is, not who you are, so the first time you connect to a row the app opens its settings and asks for your login and password. After that it remembers them.
What you add is kept separately from the file and stays on your Mac: the login, authentication and color in the app's own settings, and a remembered password in your Mac's keychain. These connections are deliberately left out of iCloud sync, so a list that belongs to your employer does not end up on your other devices. Renaming the group keeps every saved login attached. Removing the group forgets the folder and deletes those saved logins; the files themselves are never changed.
Prefer to paste a single entry?
You do not have to use the folder. The Connection string field of an ordinary Oracle connection now accepts a full descriptor, or a whole entry copied out of tnsnames.ora, spaces and line breaks included:
CLINICAL_PROD =
(DESCRIPTION =
(ADDRESS = (PROTOCOL = TCP)(HOST = clinical-prod.example.com)(PORT = 1521))
(CONNECT_DATA = (SERVICE_NAME = clinprod))
)When that field is filled in, it takes the place of the host, port and service fields.
What is not covered yet
- Challenge-response RADIUS. Setups where the server answers with a question and expects a typed reply in a second step are not supported. Push approval and the
password,passcodeform are. - RADIUS over TCPS only. Oracle 23ai and later prefer RADIUS over an encrypted TCPS listener by default. If your server accepts nothing else, this release will not connect to it yet.
- iPhone and iPad get the RADIUS sign-in but not the
tnsnames.oragroups.
On the server side nothing changes for this feature. Your DBA has already done the work if RADIUS logins function in SQL Developer. Oracle documents that setup in Configuring RADIUS Authentication, and the file formats in Local Naming Parameters in the tnsnames.ora File and Parameters for the sqlnet.ora File.
Where to get it
Both features are in version 2026.317 for macOS, which you can download here. The Mac App Store versions and the iPhone and iPad apps follow with their next updates.
If a connection that works in SQL Developer does not work here, we want to know. Use the Support button in the connection window and include the error message and your Oracle server version (select banner from v$version). If you are sorting out service names versus SIDs at the same time, our guide to ORA-12514 and ORA-12154 covers that part.
Tags: Feature Oracle
Microsoft Entra ID (MFA) sign-in for Azure SQL on Mac, iPhone and iPad
Posted by Kyle Hankinson September 28, 2026
A lot of Azure SQL databases no longer have a SQL login you can use. Many organizations turn SQL authentication off entirely and require everyone to sign in with their work account, usually with multi-factor authentication on top. Until now, that left Mac, iPhone and iPad users without a native way in.
That changes with the latest update. SQLPro Studio and SQLPro for MSSQL now sign in to SQL Server with Microsoft Entra ID (the service formerly called Azure Active Directory) on macOS, iPhone and iPad. You sign in with Microsoft the same way you do everywhere else at work, MFA prompt included, and the app connects with the token Microsoft issues. The Windows apps already supported Entra ID sign-in; this brings the Apple platforms up to the same level.
What you can connect to
Entra ID sign-in works with the SQL Server services that accept it:
- Azure SQL Database
- Azure SQL Managed Instance
Nothing changes for SQL Server authentication or Windows authentication. Existing connections keep working exactly as before.
Two ways to sign in
Open a SQL Server connection and pick one of the two new authentication types.
Microsoft Entra - Interactive (MFA). This is the one most people want. When you connect, a Microsoft sign-in window opens. Choose your account, complete whatever your organization asks for (password, Authenticator push, security key, passkey) and the connection opens. The window always shows the account picker, so if you are signed in to more than one Microsoft account you pick the right one instead of the browser quietly reusing the last one.
Microsoft Entra - Device Code. For when a browser window is not practical, or you would rather finish the sign-in on another device. The app shows a short code; go to microsoft.com/devicelogin on your phone or any computer, enter the code, and sign in there. The app waits and connects as soon as you are done.
In both cases the login field is your work address, for example jane@contoso.com. There is no password to enter in the app.
You will not be asked every time
After the first sign-in, the app keeps a refresh token in the system keychain and gets new access tokens quietly in the background. Reconnecting, opening a second window on the same server, or relaunching the app does not bring the sign-in window back. You only see Microsoft again when your organization's policy says so (a password change, a revoked session, or a sign-in frequency rule).
A few details worth knowing:
- Your password never passes through the app. You type it into Microsoft's own sign-in page. The app only receives the token Microsoft issues.
- The account is checked. If you sign in as a different account from the one in the connection's login field, the app refuses the token and tells you which account Microsoft signed in, rather than connecting you as the wrong person.
- Several connections, one prompt. Restore a workspace with five tabs on the same server and you get one sign-in, not five.
The tenant setting
Most people can ignore this. By default the sign-in uses the directory that belongs to the domain of your login, so jane@contoso.com signs in to the Contoso tenant.
Set the tenant yourself if you are a guest in another organization's directory, or if your organization's sign-in domain differs from the address in your login. On the Mac it is the Entra ID tenant field in the connection's advanced settings; on iPhone and iPad it is the Tenant field on the connection. Either the tenant's domain (company.onmicrosoft.com) or its tenant ID works.
First sign-in: consent
The first time anyone in an organization signs in, Microsoft asks whether the app may access Azure SQL Database on their behalf. Accept it once and it is not asked again.
Some organizations do not let users approve apps themselves. In that case Microsoft shows a message saying administrator approval is needed, or the sign-in ends with an error such as AADSTS65004 or access_denied. An administrator can approve the app for everyone from the Entra admin center; Microsoft describes the steps in grant tenant-wide admin consent to an application. The application ID to look for is a61530ad-aa3d-43bc-8d9d-e4e264e28263.
On the database side
Signing in with Microsoft only proves who you are. The server still has to know you. If you are setting up Entra ID access on Azure SQL for the first time:
- The logical server (or managed instance) needs a Microsoft Entra admin. You set it in the Azure portal under the server's Microsoft Entra ID settings.
- Each person or group needs a user in the database, created by that admin:
CREATE USER [jane@contoso.com] FROM EXTERNAL PROVIDER;
ALTER ROLE db_datareader ADD MEMBER [jane@contoso.com];Groups work the same way, using the group's display name, which saves adding people one at a time. Microsoft's overview of Entra authentication for Azure SQL and the configuration guide cover the rest.
If it does not connect
- "Client with IP address ... is not allowed to access the server" (Msg 40615). The sign-in worked, but the Azure SQL firewall is blocking your network. Add your address in the Azure portal under the server's networking settings, or ask whoever manages it. See Azure SQL firewall rules.
- Login failed for a user that should exist. Check the
CREATE USER ... FROM EXTERNAL PROVIDERstep above, and that you are connecting to the database the user was created in. - "Tenant not found" (AADSTS90002). Your login's domain is not the domain your directory uses for sign-in. Enter the tenant explicitly, as described above.
- The sign-in window was closed or timed out. Just connect again. Device codes expire after about 15 minutes, so a new one is issued each time.
- Signed in as the wrong account. The error names the account Microsoft used. Connect again and choose the right one in the account picker, or correct the login.
Where to get it
Entra ID sign-in is in the current releases for macOS, iPhone and iPad, in both apps. It is not in the Android apps yet. If you are new to SQL Server on the Mac, our guide to connecting to SQL Server from a Mac walks through the rest of the connection settings.
If your organization's sign-in setup does something we have not covered here, please open an issue on GitHub with the error you see. We would like to hear about it.
Tags: Feature Microsoft SQL Server
SQLPro Studio is now available on Android
Posted by Kyle Hankinson September 11, 2026
SQLPro Studio has been a native database client on the Mac since 2015, and on iPhone, iPad and Windows for years now. Today it comes to the platform people have asked about most: SQLPro Studio is available on Google Play for Android phones and tablets.
Get SQLPro Studio on Google Play
It is a native Android app, written in Kotlin, with the same database drivers that power the desktop and iOS versions. There is no web view, no Java desktop runtime and no remote service in the middle. The app talks to your database directly, the same way it does on your Mac.
What is in the first release
The databases you already use. MySQL and MariaDB, PostgreSQL (including hosted services such as Amazon RDS, Azure and Heroku), Microsoft SQL Server 2005 and later, Oracle, MongoDB, SQLite and more. Connections are per engine, so a MySQL connection gets the MySQL editor and the MySQL tree, exactly as on the desktop.
A real query editor. Syntax highlighting with light and dark themes, autocompletion for tables and columns, several query tabs open at once, find and replace, automatic formatting, and the choice of running one statement, the current selection or the whole script.
Browse and edit, not just read. A context aware database tree gives quick access to tables, views, columns and indexes. Tap a table to see its rows, then edit, insert or delete rows directly in the grid. A table designer creates and alters tables, and results export to CSV, JSON or XML. Query history and saved favourites are there too.
Secure connections. SSH tunnelling with password or private key authentication, SSL and TLS options per engine, and a scan of the local network to find database servers. Connection details are stored in the Android keystore on the device. A biometric app lock (fingerprint or face) keeps the app closed to anyone else who picks up your phone.
Sample databases built in. Not near your own server? The app ships with sample connections so you can explore the editor, the tree and the grid without setting anything up.
Licensing
SQLPro Studio for Android is free to download. A Premium unlock is needed to interact with result sets, and there are two ways to get it:
- Use the key you already have. If you subscribe to SQLPro Studio (monthly or yearly), enter your existing license key in the Android app and it unlocks. Student license keys work the same way. Subscriptions now cover macOS, iOS, Android and Windows.
- Buy inside the app. Google Play offers a monthly or yearly subscription and a one time Lifetime purchase, managed through your Play account.
One note for Lifetime customers: lifetime licenses have always been per platform (a macOS lifetime key does not unlock Windows, and the same applies to Android). An Android lifetime license is bought through Google Play inside the app.
SQLPro for MySQL and SQLPro for MSSQL too
If you only work with one database engine, the single-database apps are also on Google Play:
- SQLPro for MySQL for MySQL and MariaDB
- SQLPro for MSSQL for Microsoft SQL Server and Azure SQL
They share the same code as the Studio app, and a SQLPro Studio subscription key unlocks them as well.
Requirements
Android 10 or later, on phones and tablets, in portrait or landscape. The app follows your system light or dark setting.
Feedback
This is the first Android release, and the roadmap is driven by what people ask for. If something looks wrong, or a feature you rely on from the desktop app is missing, please open an issue on GitHub or reach out through the support page.
Tags: Feature
SQLPro Keyboard Shortcuts
Posted by Kyle Hankinson July 27, 2026
Most of the time you spend in a database client is spent in three places: the query editor, the results grid, and the connection sidebar. Moving between them with the mouse works, but it is the slowest way to do it. This article lists every keyboard shortcut
Where the shortcuts live
On macOS, open Preferences (Cmd + ,) and choose Keyboard in the sidebar. Every shortcut listed below has its own row. Click the field beside an action, press the combination you want, and it is saved immediately. There is no Apply button.
To remove a binding, click the field and press the delete button that appears at its right edge. To restore an individual shortcut, clear it and reopen the window.
On Windows, open Preferences and choose Keyboard. The Windows build currently exposes a smaller set of rebindable actions than the macOS build; the table further down lists what is configurable today.
macOS defaults
Running queries
| Action | Default |
|---|---|
| Query execution | Shift + Cmd + E |
| Query execution (secondary) | not assigned |
| Format query | Shift + Cmd + K |
| Comment/uncomment | Cmd + - |
Query execution (secondary) exists so you can bind a second key to the same action. A common setup is to leave the primary at Shift + Cmd + E and add Cmd + Return as the secondary, which matches the muscle memory from a lot of other tools.
Comment/uncomment works on the current line, or on every line touched by the selection. It uses -- followed by a space, which matters for MySQL, where a comment marker without trailing whitespace is not treated as a comment.
Connections and navigation
| Action | Default |
|---|---|
| Connect | Shift + Cmd + C |
| Focus database tree | Ctrl + D |
| Focus database tree search | Ctrl + F |
| Previous tab | Shift + Cmd + [ |
| Next tab | Shift + Cmd + ] |
Ctrl + F jumps straight to the sidebar filter, which is usually faster than scrolling a large schema. Note that these two use Ctrl rather than Cmd, so they do not collide with the standard macOS find and duplicate shortcuts in the editor.
Alongside the tab shortcuts above, Cmd + 1 through Cmd + 9 switch directly to a tab by position. That behaviour is on by default and can be turned off with the checkbox in the same Keyboard preferences pane, which is worth doing if you would rather those keys stay free.
Results
| Action | Default |
|---|---|
| Hide/show query results | Cmd + K |
| Find column | Cmd + B |
| Toggle results/messages | not assigned |
| Copy selected with headers as CSV | not assigned |
| Export full result set as CSV | not assigned |
| Export full result set as JSON | not assigned |
| Export full result set as XML | not assigned |
Find column is the one people tend to miss. On a result set that is a hundred columns wide, Cmd + B beats horizontal scrolling.
The five unassigned actions here are the ones worth setting up first, because they have no default and are easy to reach for repeatedly. If you export the same result set shape every day, giving CSV export a binding removes several clicks each time.
Text editing
| Action | Default |
|---|---|
| Make uppercase | not assigned |
| Make lowercase | not assigned |
Both are unassigned by default. They apply to the current selection in the editor.
Multiple cursors
Multi-cursor editing has its own set of keys, and they are not configurable:
- Hold
Optionand drag the mouse up or down between lines Cmd+Option+↑/↓to add cursors above or belowShift+Option+Iturns a multi-line selection into one cursor per line
Once several cursors are active, the usual text-movement keys apply to all of them at once: ←/→ by character, Option + ←/→ by word, adding Shift to any of those to select rather than move. Cmd + Delete deletes to the end of the next word from every cursor, and Option + Delete deletes to the end of the line.
Windows defaults
| Action | Default |
|---|---|
| Query execution | Ctrl + Shift + E |
| Format query | Ctrl + K |
| Hide/show query results | Ctrl + R |
| Query history | Ctrl + Shift + H |
The first three are rebindable from Preferences > Keyboard. Query history has a working default but no row in the preferences pane yet, so it cannot currently be changed.
If you are coming from SQL Server Management Studio, the layout will feel close but not identical. Ctrl + K is format-query here rather than the first half of a chord, so the SSMS comment pair Ctrl + K, C and Ctrl + K, U do not carry over.
Picking bindings that stick
Two things are worth knowing before you rebind much.
Shortcuts are validated as you set them. If you choose a combination the system has already claimed, or one already used by another action in
Your choices are stored per application rather than per connection, so a binding you set while working against Postgres applies just as well when you open a SQL Server connection later.
If a shortcut you want is missing
The list above is what exists today. If there is an action you reach for constantly and it has no row in the Keyboard pane, that is worth telling us about, because the pane is straightforward to extend and requests genuinely drive what gets added. The same goes for defaults that feel wrong for your platform.
Tags: Feature Support
Export from to CSV, JSON or XML
Posted by Kyle Hankinson August 9, 2023
export to CSV, JSON or XML
You can use
To export from a table or view, find the target in the database tree and right click on it. Choose 'Export as', then pick from either CSV, JSON or XML from one of the submenus.
Similar, when exporting from a results set either right click (or single click the arrow at the top left of resutls) and choose 'Export result set as' and pick from one of the options.