OneDB v3.6.0

Release Date: Aug 2026
Release Type: Feature and Security Enhancement Release
Branch: 3.6.0

Overview

OneDB v3.6.0 introduces Field Settings Mode, extending OneDB’s field-level data protection capabilities with configurable Tokenize and Detokenize behavior across all supported database platforms.

This release also delivers significant enhancements to database migration, Oracle and Db2 protocol handling, MongoDB compatibility, migration monitoring, and administrative usability while maintaining backward compatibility with existing OneDB configurations.

What’s New in v3.6.0

Field Settings Mode

OneDB Field Settings now includes a new Mode option for fields using token-based templates.

Two modes are available:

Tokenize : transforms plain database values into tokenized values before they are returned to the client.
Detokenize : restores tokenized database values and, when configured, applies presentation masking before returning the result to the client.

Mode is available only when a token template is selected.

For No Setting and Direct Masking, Mode is not applicable and remains disabled.

Existing token-based Field Settings created before v3.6.0 continue operating with their previous behavior and are treated as Tokenize by default.

Cross-Database Field Settings Mode Support

Field Settings Mode is now supported across all OneDB-supported database platforms:

PostgreSQL
MySQL
Microsoft SQL Server
Oracle
MongoDB
Db2

OneDB applies the selected Tokenize or Detokenize behavior while preserving the native database protocol and existing Field Settings functionality.

Existing No Setting and Direct Masking configurations continue to operate unchanged.

Detokenize with Presentation Masking

Detokenized values can optionally be combined with the configured presentation masking.

For example, OneDB can:

Retrieve a tokenized value from the database.
Detokenize it internally.
Apply the configured SIMPLE or REGEX masking.
Return only the presentation-safe value to the client.

When no presentation masking is configured, the clear detokenized value is returned according to the Field Settings configuration.

This allows organizations to store tokenized information while controlling exactly how authorized applications or users view that information.

PostgreSQL Mode Support

PostgreSQL listeners now support Mode-aware field protection for query result sets.

Token-based Field Settings can return either:

tokenized values using Tokenize, or
detokenized and optionally presentation-masked values using Detokenize.

The implementation preserves existing PostgreSQL result-set behavior, including SQL NULL, empty values, UTF-8 data, and standard client connectivity.

MySQL Mode Support

MySQL listeners now support Field Settings Mode for supported result-set processing.

Mode-aware transformation is supported for standard MySQL result rows and supported prepared-statement result processing.

Existing MySQL Field Settings behavior remains compatible with previous releases.

Microsoft SQL Server Mode Support

Microsoft SQL Server listeners now support Field Settings Mode for supported text fields.

OneDB can safely transform protected values even when the transformed value has a different length from the original database value.

This release also strengthens Microsoft SQL Server listener encryption handling.

Plaintext OneDB listeners continue operating as inspectable database connections, while clients that explicitly require encrypted connectivity must connect through a secure OneDB listener.

This ensures OneDB security controls such as:

Query Audit
Query Whitelist
Protection Rules
Field Settings
Tokenize and Detokenize processing

remain active throughout supported database sessions.

Oracle Mode and Result-Set Enhancements

Oracle listeners now support Field Settings Mode for supported VARCHAR2 result fields.

Both plaintext and secure Oracle listeners use the same Mode-aware processing behavior, providing consistent Tokenize and Detokenize functionality regardless of frontend transport configuration.

This release also significantly improves Oracle result-set compatibility, including:

multiple protected columns within the same query
Oracle SQL Developer Table/Data views
mixed datatype result sets
repeated fetch operations
large and multi-column result sets
ROWID and ORA_ROWSCN projections
supported Oracle timestamp results
fragmented and combined Oracle network traffic

Oracle secure and plaintext listeners now provide improved transport-independent packet processing, increasing reliability when database traffic is fragmented across multiple network reads.

Db2 Mode Support

Db2 listeners now support Field Settings Mode for supported UTF-8 VARCHAR fields.

Both plaintext and TLS-enabled Db2 listeners support:

Tokenize
Detokenize
Detokenize with presentation masking

OneDB preserves Db2 NULL, empty-string, prepared-statement, repeated-query, and cursor behavior during Mode-aware processing.

Existing Db2 Direct Masking and No Setting behavior remains unchanged.

MongoDB Mode Support

MongoDB listeners now support Field Settings Mode for supported BSON String fields.

Mode-aware protection can be applied to:

top-level fields
nested document fields
supported deeper nested paths
supported arrays containing embedded documents
find results
aggregate results
cursor getMore results

Multiple protected MongoDB fields can use different templates and Modes within the same returned document.

Both plaintext and secure MongoDB listeners support Mode processing.

Presentation masking continues to follow the SIMPLE or REGEX configuration defined by the administrator.

Migration Enhancements

MongoDB Migration Transformation

MongoDB migration has been improved to provide more reliable protected-field transformation, particularly for case-sensitive and camelCase BSON field names.

OneDB now correctly distinguishes paths such as:

firstName
firstname

while preserving the actual MongoDB document structure.

Migration validation has also been strengthened so configured protected fields cannot silently remain untransformed.

MongoDB migration supports:

Tokenize protected fields
Detokenize protected fields
unchanged migration of unprotected fields

Presentation masking is intentionally not applied during migration because migration transforms stored data rather than client-facing presentation.

Db2 Migration Parity

Db2 migration has been aligned with OneDB’s common relational database migration workflow.

Enhancements include:

consistent Db2 schema visibility
optional Target Table Name
automatic target-table naming
collision-safe generated table names
target-table creation
supported Db2 datatype mapping
Create table if not exists
Drop and recreate
Truncate before insert
append migration

When no Target Table Name is supplied, OneDB automatically generates a name using the standard migration convention, for example:

CUSTOMERS_onedb_migrated

If that table already exists, OneDB automatically generates the next available name.

Existing Db2 migration jobs remain backward compatible.

Migration Jobs UI

The Migration Jobs page has been simplified to focus on the actual data transformation being performed.

The previous Job Action column has been removed from the primary migration view and replaced with Data Transformation.

Migration jobs can now display:

Tokenize
Detokenize

Historical migration records remain available and backward compatible.

Migration Failure Reporting

OneDB now provides improved migration failure reporting.

Failed migration jobs can retain structured information about where the failure occurred, including stages such as:

validation
target-table creation
data transformation
data transfer
finalization

Failure information remains available after page refresh or OneDB restart, making unsuccessful migrations easier to investigate.

Error reporting is designed to avoid exposing protected values, tokens, cryptographic keys, or other sensitive transformation data.

MongoDB Compass Compatibility

OneDB v3.6.0 improves compatibility with MongoDB Compass.

Supported MongoDB Compass handshake metadata is now recognized correctly while maintaining OneDB’s strict validation of unsupported legacy MongoDB traffic.

MongoDB Compass connectivity has been validated through both:

plaintext MongoDB listeners
secure MongoDB listeners

Existing MongoDB query, write, protection, and malformed-message validation remains enforced.

Listener Management Enhancement

The Database Type filter on the Listener Management page has been corrected and now consistently includes all supported database platforms:

PostgreSQL
MySQL
Microsoft SQL Server
Oracle
MongoDB
Db2

Database Type filtering can continue to be combined with other Listener filters such as:

Status
Secure Connection
Port
Connection Name

Administration and Configuration

The Field Settings Administration interface has been updated to include the new Mode configuration.

For existing token-template Field Settings created before v3.6.0, the interface displays Tokenize as the effective behavior while retaining backward-compatible configuration internally until the Mode is explicitly changed.

Backup and restore operations now also include Field Settings Mode configuration.

Required database schema updates are applied automatically during upgrade.

Security and Reliability Improvements

OneDB v3.6.0 includes additional safeguards around field-level transformation and database protocol processing.

Enhancements include:

safer handling of transformation failures
protection against partially transformed result sets
preservation of existing Direct Masking and No Setting behavior
improved secure and plaintext listener consistency
strengthened migration error handling
improved handling of fragmented database network traffic
preservation of database-native NULL, empty-value, and encoding semantics
backward-compatible configuration and schema upgrades

These improvements help ensure protected information is not unintentionally exposed if an explicit Tokenize or Detokenize operation cannot be completed safely.

Backward Compatibility

OneDB v3.6.0 is designed to preserve existing configurations and behavior.

In particular:

Existing token-template Field Settings with no explicit Mode continue operating as Tokenize.
Existing Direct Masking configurations remain unchanged.
Existing No Setting configurations remain unchanged.
Existing migration jobs remain readable.
Existing Db2 migration configurations remain supported.
Existing Listener and Connection transport configurations remain independent.
Required schema changes are applied automatically during upgrade.

No manual conversion of existing Field Settings is required.

Summary

OneDB v3.6.0 significantly expands field-level data protection by introducing Tokenize and Detokenize Modes across PostgreSQL, MySQL, Microsoft SQL Server, Oracle, MongoDB, and Db2.

Together with enhanced presentation masking, database migration improvements, stronger Oracle protocol processing, MongoDB Compass compatibility, Db2 migration parity, improved migration diagnostics, and Listener Management enhancements, this release provides greater control over how protected data is stored, transformed, and presented to database clients.