I am currently using StarRocks version 4.0.0-rc1 and have integrated Keycloak (OAuth2/OIDC) for user authentication via redirect URL. The setup works as expected when connecting through the MySQL client: • After executing a query, a redirect URL is generated. • I can log in via Keycloak successfully using my credentials. However, I am facing an issue when connecting through JDBC using:

jdbc:mysql://<fe_host>:9030/<db_name>

In this case: The username provided in the JDBC connection is not being passed to Keycloak. • During authentication, even after entering valid credentials, I receive a "user not found" error. • The same user exists in both Keycloak and StarRocks. I have tried multiple approaches, but the issue persists. Could you please help me understand: • Why the JDBC connection is not passing the username to Keycloak? • Whether this is a known limitation or if any specific configuration is required? Any guidance or documentation would be greatly appreciated. Thanks in advance! + @Rocky

Hello! I'm Rocky. Dealing with OIDC/OAuth2 integration in StarRocks can be tricky, especially when transitioning from the MySQL CLI to JDBC. Based on the behavior you described, where it works for the MySQL client but fails with "user not found" during JDBC authentication, here are the most likely causes and solutions: 1. Principal Field Mismatch (Most Likely) The "user not found" error typically occurs after the Keycloak login is successful. At this stage, Keycloak redirects back to StarRocks with a token. StarRocks then looks for a specific field in that token (the Principal) to identify which StarRocks user is logging in. * The Issue: By default, StarRocks looks at the

sub

field in the JWT. In Keycloak, the

sub

field is usually a UUID (e.g.,

550e8400-e29b...

), while your StarRocks user is likely named something like

alice

. * The Fix: You need to ensure the

principal_field

in your StarRocks configuration matches the field in Keycloak that contains the actual username (usually

preferred_username

). Check your User or Security Integration configuration:

sql
-- If using Security Integration (Recommended)
CREATE SECURITY INTEGRATION keycloak_integration
PROPERTIES (
    "type" = "authentication_oauth2",
    "principal_field" = "preferred_username",  -- Keycloak usually stores the login name here
    ...
);

-- Or if configuring on the specific user
ALTER USER 'your_username' IDENTIFIED WITH authentication_oauth2 AS '{
  "principal_field": "preferred_username",
  ...
}';

Note: If it works in the MySQL client, verify that the MySQL client is actually using the same user and authentication method. 2. Username Passing and JDBC Plugin You mentioned the username isn't being passed to Keycloak. In the OIDC Authorization Code flow, the StarRocks FE redirects your browser to Keycloak. * Username Hint: StarRocks does not currently pass the JDBC

user

property as a

login_hint

to Keycloak's login page. This is standard OIDC behavior—the user is expected to identify themselves directly to the Identity Provider (Keycloak). * The Handshake: Standard JDBC drivers (like

mysql-connector-java

) do not natively handle the interactive "Redirect URL" flow. While you can copy the URL manually, it is recommended to use the StarRocks JDBC OAuth2 Plugin. This plugin automates the browser opening and token exchange process. You can find the implementation details in the StarRocks GitHub repository. 3. Verify FE Logs for Identity Mapping To see exactly what username StarRocks is trying (and failing) to find, check the

fe.log

on your Leader FE node. Look for entries around the time of the failed login. You will likely see a log message similar to:

User [some_value] not found in StarRocks

If

[some_value]

is a UUID or an email address instead of your StarRocks username, it confirms that your

principal_field

mapping is incorrect. 4. Connection String Parameters Ensure your JDBC connection string is not forcing a specific authentication plugin that might conflict with the OAuth2 switch:

jdbc:mysql://<fe_host>:9030/<db_name>?useSSL=false&allowPublicKeyRetrieval=true

Summary of Recommendations: 1. Check `fe.log`: Identify the exact "principal" string StarRocks is extracting from the Keycloak token. 2. Adjust `principal_field`: Set it to

preferred_username

(or whichever claim contains the human-readable username) in your StarRocks OAuth2 settings. 3. Check Case Sensitivity: StarRocks usernames are case-sensitive. If Keycloak returns

Alice

but your user is

alice

, it will fail. 4. Try the Plugin: If this is for an application or BI tool, use the

starrocks-jdbc-oauth2-plugin

to handle the flow seamlessly. Since you are using 4.0.0-rc1, ensure your FE configuration files (

fe.conf

) have the global

oauth2_principal_field

set if you aren't defining it per-user.

@Rocky created security integration using oauth2 , but still its not showing in logs,and its not working . i did not create the user as doc says it will automatically create virtual user for some time https://docs.starrocks.io/docs/administration/user_privs/authentication/security_integration/#see-also

None References • administration/user_privs/authentication/security_integration.md • best_practices/authentication_authorization.md