Firebird Server ↔ Jaybird JDBC: DatabaseAccess Restriction Impact on Connection Paths

Answer to the Question

When you move from a developer workstation to a production machine that runs Firebird under a restricted account, the DatabaseAccess setting in firebird.conf can block Jaybird JDBC connections that previously worked. In Firebird 3.0+ the default is Restrict, which allows database files only in directories listed in the configuration. If the production database resides outside that list, Jaybird will return an unavailable database error.

Likely Explanation

• The server process runs with the service account’s permissions, so any path not on the whitelist is denied, regardless of the JDBC client’s privileges.
• Jaybird does not negotiate DatabaseAccess; it simply passes the database file name to the server, which then applies the restriction.
• External tables and UDFs are governed by ExternalFileAccess, which is independent but also respects a separate whitelist when set to Restrict.

Confirmed Facts (from Firebird docs and community experience)

• Setting DatabaseAccess=Full restores the pre‑3.0 behavior: any absolute path is accepted, but the server can access the entire filesystem.
• When DatabaseAccess=Restrict, the DatabaseAccess whitelist in firebird.conf must include every directory that contains a database file used by the application.
• If ExternalFileAccess=Restrict, any external file referenced by a stored procedure or UDF must also be on its whitelist; otherwise the operation fails silently or with a generic error.
• Upgrading from Firebird 2.5 (where DatabaseAccess=None) to 3.0+ requires adding the existing database directories to the whitelist if you wish to keep the restrictive mode.

Steps for Your Production Environment

1. Locate the absolute path of the database file that Jaybird uses in production (e.g., C:\Data\ProdDB.fdb).

2. Open firebird.conf and set:

   DatabaseAccess=Restrict
   DatabaseAccess=\C:\Data
   

   Add each directory that contains a database file.

3. Check the ExternalFileAccess setting. If your stored procedures or UDFs read external files, add those directories to the ExternalFileAccess whitelist or set it to Full for a temporary test.

4. Restart the Firebird service under the restricted account.

5. From the same service account, run a simple Jaybird JDBC test:

   String url = "jdbc:firebirdsql://localhost:3050/C:/Data/ProdDB.fdb";
   Connection con = DriverManager.getConnection(url, "SYSDBA", "masterkey");
   System.out.println("Connected: " + con.isValid(1));
   

   If the connection succeeds, the whitelist is correct.

6. Audit any external file access. If a UDF fails, verify the file path against the ExternalFileAccess whitelist.

7. Once verified, consider tightening the ExternalFileAccess to Restrict again if you switched to Full for testing.

Missing Diagnostic Detail Needed for a Precise Recommendation

Could you confirm the current value of ExternalFileAccess in your firebird.conf and whether any stored procedures or UDFs read external files? This will determine if you need to adjust that whitelist as well.