@Rocky Is it possible to connect to starrocks from reporting tools like power bi or tableau using oauth2.0? We are using v3.5

Yes, it is possible to connect to StarRocks from reporting tools like Power BI and Tableau using OAuth 2.0 starting from StarRocks version 3.5. With the release of v3.5, StarRocks introduced formal support for OAuth 2.0 authentication for both the Web UI and JDBC driver connections. Since both Tableau and Power BI can connect to StarRocks via JDBC, you can leverage this feature. 1. How it works StarRocks v3.5 supports the Authorization Code flow. When a reporting tool (acting as a JDBC client) attempts to connect: * The connection triggers an authentication request. * The user is redirected to their identity provider's (IdP) login page (e.g., Azure AD/Entra ID, Okta, Keycloak). * After successful login, the browser redirects back to the StarRocks FE, which exchanges the code for a token to authorize the session. 2. Implementation Steps To enable this for your BI tools, you need to perform the following configuration: A. Configure StarRocks (v3.5+) You must first define the OAuth 2.0 settings in StarRocks. You can do this by creating a Security Integration:

sql
CREATE SECURITY INTEGRATION oauth2_integration
PROPERTIES (
    "type" = "authentication_oauth2",
    "auth_server_url" = "https://<your_idp>/auth",
    "token_server_url" = "https://<your_idp>/token",
    "client_id" = "<your_client_id>",
    "client_secret" = "<your_client_secret>",
    "redirect_url" = "http://<starrocks_fe_ip>:<fe_http_port>/api/oauth2",
    "jwks_url" = "https://<your_idp>/certs",
    "principal_field" = "preferred_username"
);

Then, create users identified with this integration:

sql
CREATE USER '<mailto:your_email@company.com|your_email@company.com>' IDENTIFIED WITH authentication_oauth2;

B. Setup in Tableau Tableau connects to StarRocks using the StarRocks Tableau JDBC Connector. * Driver: You must use the MySQL JDBC driver. * Plugin: To support the OAuth 2.0 handshake (opening the browser), you should use the starrocks-jdbc-oauth2-plugin. This plugin is a wrapper that automatically launches the browser for login when Tableau initializes the connection. C. Setup in Power BI Power BI can connect via the official StarRocks Power BI Connector or a generic ODBC/JDBC connection. * For OAuth 2.0, the recommended path in v3.5 is using the JDBC connection with the OAuth2 plugin mentioned above. * Note: While StarRocks supports the protocol, Power BI's "Sign In" button (Microsoft Account) is typically reserved for AAD-native integrations. For StarRocks, you will likely use the JDBC driver's ability to trigger a system browser popup for the OAuth flow. Important Notes: * Version Requirement: Ensure you are on v3.5.0 or later. Earlier versions (v3.2–v3.4) support LDAP and JWT but do not have the full OAuth 2.0 Authorization Code flow for BI tools. * Redirect URL: The

redirect_url

must be accessible by the user's browser and correctly point to the StarRocks FE HTTP port. * MySQL Client 9.2+: If you are using native MySQL protocols (rather than JDBC), the client version must be 9.2 or later to support the OpenID pluggable authentication. References • administration/user_privs/authentication/oauth2_authentication.md • integrations/BI_integrations/Tableau_Desktop.md