@Rocky does starrocks support jwt authentication from tools like dbeaver?

Yes, StarRocks supports JWT (JSON Web Token) authentication starting from v3.5.0. You can connect from tools like DBeaver by leveraging the MySQL protocol and specific JDBC driver properties. Since StarRocks is compatible with the MySQL wire protocol, it uses the same authentication mechanism as MySQL's OpenID Connect plugin. 1. Prerequisites * StarRocks Version: v3.5.0 or later. * DBeaver Driver: You must use MySQL Connector/J version 9.1.0 or later. Older drivers do not support the required OpenID Connect properties. * User Setup: The user must be created in StarRocks with the

authentication_jwt

method. 2. How to Set Up in DBeaver To connect using a JWT token in DBeaver, follow these steps: Step A: Configure the Connection 1. Create a new connection using the MySQL driver. 2. In the Main tab, enter your StarRocks FE Host, Port (default

9030

), and Database. 3. Enter the Username that matches the

principal_field

(usually

sub

or

email

) inside your JWT. 4. Leave the Password field empty (the token will be provided via a file). Step B: Set Driver Properties Go to the Driver Properties tab and add/edit the following properties: *

idTokenFile

: Set this to the absolute local path of the file containing your JWT token (e.g.,

/Users/name/tokens/starrocks_jwt.txt

). *

authenticationOpenidConnectCallbackHandler

: Set this to

com.mysql.cj.callback.MysqlCallbackHandler

(this is the default in newer drivers, but good to verify). *

sslMode

: It is highly recommended (and often required by the plugin) to set this to

REQUIRED

or

VERIFY_CA

to ensure the token isn't sent over an unencrypted connection. 3. Server-Side Configuration (Example) Before connecting, the user must exist in StarRocks. You can create a user tied to JWT like this:

sql
-- Create a user that authenticates via JWT
CREATE USER '<mailto:tom@example.com|tom@example.com>' IDENTIFIED WITH authentication_jwt AS
'{
  "jwks_url": "<https://your-auth-provider.com/certs>",
  "principal_field": "email",
  "required_issuer": "<https://your-auth-provider.com>",
  "required_audience": "starrocks_client_id"
}';

Summary of Requirements Requirement | Value StarRocks Version | 3.5.0+ DBeaver Driver | MySQL Connector/J 9.1.0+ Auth Plugin |

authentication_openid-connect_client

JDBC Property |

idTokenFile

= path to your token file Note: If you are using OAuth 2.0 (which involves a browser redirect), StarRocks provides a specific plugin called

starrocks-jdbc-oauth2-plugin

to handle the interactive login flow, but for a pre-obtained JWT, the standard

idTokenFile

property in DBeaver is the most direct method. References • administration/user_privs/authentication/jwt_authentication.md • administration/user_privs/authentication/oauth2_authentication.md • administration/management/FE_configuration.md • administration/user_privs/authentication/security_integration.md

@Rocky what about power bi, tableau etc?

Yes, StarRocks supports JWT and OAuth 2.0 authentication (from version v3.5.0 onwards) for BI tools like Tableau and Power BI, but the implementation details vary depending on the tool's connection method. Since StarRocks is compatible with the MySQL wire protocol, these tools typically connect using MySQL drivers, which have recently added support for the

authentication_openid-connect_client

plugin. 1. Tableau Tableau has the most robust support via the StarRocks Tableau JDBC Connector (available on the Tableau Exchange). * How it works: The connector uses the MySQL JDBC driver. * JWT Setup: Just like in DBeaver, you can pass the necessary authentication properties. Since the connector is JDBC-based, you can often specify the

idTokenFile

(the path to your JWT token) in the connection string or driver configuration. * OAuth 2.0: StarRocks provides a starrocks-jdbc-oauth2-plugin specifically for JDBC-based tools. When you attempt to connect, it can trigger a browser-based login flow, making it seamless for Tableau Desktop users. 2. Power BI Connecting Power BI to StarRocks using JWT is currently more specialized compared to DBeaver or Tableau. * Standard MySQL Connector: The built-in Power BI MySQL connector (which uses ODBC or Power Query) does not natively support the "path to token file" (

idTokenFile

) property or the interactive OAuth 2.0 flow used by StarRocks. * CelerData Power BI Connector: CelerData (the enterprise sponsor of StarRocks) provides a dedicated Power BI connector that supports DirectQuery and more advanced authentication methods. * Workaround for OSS: If you are using the open-source version, you may need to use a Generic ODBC connection with a MySQL ODBC driver (v9.1.0+) and configure the

idTokenFile

in the DSN (Data Source Name) settings on your Windows machine. Summary Table Tool | Recommended Connection | JWT/OAuth Support DBeaver | MySQL JDBC | Supported via

idTokenFile

property. Tableau | StarRocks JDBC Connector | Supported via JDBC properties or the StarRocks OAuth2 plugin. Power BI | StarRocks/CelerData Connector | Full Support in the dedicated connector; limited/manual via standard MySQL ODBC. MySQL CLI | native client (v9.2+) | Supported via

--authentication-openid-connect-client-id-token-file

. Important Configuration Note For any of these tools to work with JWT, the user must be created in StarRocks with the

authentication_jwt

method:

sql
CREATE USER 'your_user_email' IDENTIFIED WITH authentication_jwt AS
'{
  "jwks_url": "<https://auth.example.com/certs>",
  "principal_field": "email"
}';

If you are using OAuth 2.0 for an interactive "Login with SSO" experience in your BI tool, you should use the

authentication_oauth2

method instead. References • administration/user_privs/authentication/jwt_authentication.md • administration/user_privs/authentication/oauth2_authentication.md