Secure 5.2: Connect Liquibase with Teradata (TD2)

Connect to Teradata with Liquibase using TD2 authentication

Last updated: June 9, 2026

Configure Liquibase to connect to Teradata using TD2 authentication. TD2 is the default Teradata authentication mechanism. It requires only a username and password with no additional LOGMECH parameters are needed.

Before you begin

Liquibase Secure 5.1.1+
Teradata JDBC driver — The Teradata JDBC driver is not included and must be downloaded from Teradata. Place the driver in the liquibase/lib directory.

Procedure

Configure your liquibase.properties

Add the following to your liquibase.properties file. Be sure to:

Replace your_changelog.xml with the path to your changelog file
Replace your_hostname with your Teradata server hostname
Replace your_database with your database name
Replace your_username with your Teradata username
Replace your_password with your Teradata password

changeLogFile=your_changelog.xml
liquibase.command.url=jdbc:teradata://your_hostname/DATABASE=your_database
liquibase.command.username=your_username
liquibase.command.password=your_password

You can also configure optional BTEQ-specific properties:

# Path to BTEQ executable (default: bteq, assumes it is on PATH)
liquibase.bteq.path=bteq

# Timeout in seconds (-1 = no timeout)
liquibase.bteq.timeout=300

Environment variables

As an alternative to liquibase.properties, set these environment variables. Be sure to replace your_hostname, your_database, your_username, and your_password with your actual values.

export LIQUIBASE_COMMAND_URL="jdbc:teradata://your_hostname/DATABASE=your_database"
export LIQUIBASE_COMMAND_USERNAME="your_username"
export LIQUIBASE_COMMAND_PASSWORD="your_password"

Create a changelog file

Create a basic changelog file to verify the connection. Be sure to:

Replace your_author with your name or identifier
Save the file using the same name you set for your_changelog.xml in Step 1

--liquibase formatted sql

--changeset your.name:1
CREATE TABLE test_table (test_id INT NOT NULL, test_column INT, PRIMARY KEY (test_id) NOT ENFORCED)

databaseChangeLog:
   - changeSet:
       id: 1
       author: your.name
       changes:
       - createTable:
           tableName: test_table
           columns:
           - column:
               name: test_id
               type: INT
               constraints:
                   primaryKey:  true
                   nullable:  false
           - column:
               name: test_column
               type: INT

{
  "databaseChangeLog": [
    {
      "changeSet": {
        "id": "1",
        "author": "your.name",
        "changes": [
          {
            "createTable": {
              "tableName": "test_table",
              "columns": [
                {
                  "column": {
                    "name": "test_id",
                    "type": "INT",
                    "constraints": {
                      "primaryKey": true,
                      "nullable": false
                    }
                  }
                },
                {
                  "column": {
                    "name": "test_column",
                    "type": "INT"
                  }
                }
              ]
            }
          }
        ]
      }
    }
  ]
}

<?xml version="1.0" encoding="UTF-8"?>
<databaseChangeLog
    xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns:ext="http://www.liquibase.org/xml/ns/dbchangelog-ext"
    xmlns:secure="http://www.liquibase.org/xml/ns/secure"
    xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog
        http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-latest.xsd
        http://www.liquibase.org/xml/ns/dbchangelog-ext
        http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-ext.xsd
        http://www.liquibase.org/xml/ns/secure
        http://www.liquibase.org/xml/ns/secure/liquibase-secure-latest.xsd">

    <changeSet id="1" author="your.name">
        <createTable tableName="test_table">
            <column name="test_id" type="int">
                <constraints primaryKey="true" nullable="false" />
            </column>
            <column name="test_column" type="int"/>
        </createTable>
    </changeSet>

</databaseChangeLog>

--liquibase formatted sql

--changeset your.name:1
CREATE TABLE test_table (test_id INT NOT NULL, test_column INT, PRIMARY KEY (test_id) NOT ENFORCED)

databaseChangeLog:
   - changeSet:
       id: 1
       author: your.name
       changes:
       - createTable:
           tableName: test_table
           columns:
           - column:
               name: test_id
               type: INT
               constraints:
                   primaryKey:  true
                   nullable:  false
           - column:
               name: test_column
               type: INT

{
  "databaseChangeLog": [
    {
      "changeSet": {
        "id": "1",
        "author": "your.name",
        "changes": [
          {
            "createTable": {
              "tableName": "test_table",
              "columns": [
                {
                  "column": {
                    "name": "test_id",
                    "type": "INT",
                    "constraints": {
                      "primaryKey": true,
                      "nullable": false
                    }
                  }
                },
                {
                  "column": {
                    "name": "test_column",
                    "type": "INT"
                  }
                }
              ]
            }
          }
        ]
      }
    }
  ]
}

<?xml version="1.0" encoding="UTF-8"?>
<databaseChangeLog
    xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns:ext="http://www.liquibase.org/xml/ns/dbchangelog-ext"
    xmlns:secure="http://www.liquibase.org/xml/ns/secure"
    xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog
        http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-latest.xsd
        http://www.liquibase.org/xml/ns/dbchangelog-ext
        http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-ext.xsd
        http://www.liquibase.org/xml/ns/secure
        http://www.liquibase.org/xml/ns/secure/liquibase-secure-latest.xsd">

    <changeSet id="1" author="your.name">
        <createTable tableName="test_table">
            <column name="test_id" type="int">
                <constraints primaryKey="true" nullable="false" />
            </column>
            <column name="test_column" type="int"/>
        </createTable>
    </changeSet>

</databaseChangeLog>

Verify the connection

Run the following command to confirm Liquibase can connect to your Teradata instance:

liquibase update

A successful response looks like:

Liquibase command 'update' was executed successfully.

Store credentials with Teradata Wallet (recommended for production)

Teradata Wallet provides encrypted credential storage so that passwords are not stored in plaintext configuration files. Create a wallet entry on the host where Liquibase runs. Be sure to:

Replace your_database with your Teradata database name
Replace your_username with your Teradata username
Replace your_password with your Teradata password

tdwallet add -alias your_database -logon your_username,your_password

Then reference the wallet alias in your JDBC URL. Consult the Teradata Wallet documentation for the exact URL syntax supported by your Teradata JDBC driver version.