@Rocky Is OIDC support in StarRocks stable?

OIDC support in StarRocks is considered stable as of version 3.5.0. While it is a relatively new feature, it is part of the v3.5 "Stable" branch and is documented as a primary authentication method rather than an experimental or beta feature. Key Details of OIDC/OAuth 2.0 Support: * Version Introduced: v3.5.0. * Protocols & Methods: It supports the OAuth 2.0 Authorization Code flow and JSON Web Tokens (JWT). * Supported Clients: * Web UI: Direct login via your OIDC provider. * JDBC & MySQL Clients: Supports authentication through a browser-based flow (the server returns a URL to visit for login) or via the

starrocks-jdbc-oauth2-plugin

. * Security Integration: You can manage OIDC configurations using the

CREATE SECURITY INTEGRATION

statement, which simplifies connecting to external Identity Providers (IdPs) like Okta, Azure AD, or Google. Recommendation If you are on a version earlier than 3.5.x, you will need to upgrade to access these features. Because this was introduced in v3.5.0, it is recommended to use the latest patch version (e.g., 3.5.1 or later) to benefit from the most recent bug fixes. For detailed configuration steps, you can refer to the official OAuth 2.0 Authentication documentation. References • administration/management/FE_configuration.md • administration/user_privs/authentication/oauth2_authentication.md

@Rocky Can OIDC be used with the MySQL CLI as well? I’m curious about the flow.

Yes, you can use the MySQL CLI with OIDC, but there are specific version requirements and a slightly manual flow for the terminal environment. 1. Version Requirement To use OIDC with a MySQL client, you must use MySQL Client v9.2 or later. This is because StarRocks relies on the

authentication_openid_connect

plugin introduced in that version of the MySQL client. 2. The Authentication Flow Since a terminal cannot automatically open a browser window, the flow works as follows: 1. Initiate Connection: You run your standard MySQL connect command (e.g.,

mysql -u username -h <fe_ip> -P 9030

). 2. Receive URL: Instead of immediately logging in, the StarRocks server will return a specific Authorization URL printed directly in your terminal. 3. Browser Authentication: You must manually copy this URL and paste it into a web browser on your machine. 4. Complete Login: Log in to your Identity Provider (e.g., Okta, Azure AD, Google) via the browser. 5. Session Activation: Once the browser confirms "Authentication Successful," your MySQL CLI session in the terminal will automatically unlock and grant you access to the prompt. 3. StarRocks Configuration On the StarRocks side, you need to create the user with the

authentication_oauth2

method:

sql
CREATE USER 'your_user' IDENTIFIED WITH authentication_oauth2;

(This assumes you have already configured the global OAuth2 settings in your

fe.conf

or via a Security Integration.) Summary for Terminal Users While it works, it is a "browser-assisted" flow. If you are in a purely headless environment (no browser access at all), you might need to look into JWT-based authentication instead, where you can pass a pre-generated token. References • administration/user_privs/authentication/oauth2_authentication.md • administration/user_privs/authentication/jwt_authentication.md • administration/user_privs/authentication/oauth2_authentication.md • administration/user_privs/authentication/jwt_authentication.md References • administration/user_privs/authentication/oauth2_authentication.md • administration/user_privs/authentication/jwt_authentication.md

@Rocky Is

CREATE USER

strictly required? Is there any way to skip user creation and go straight to authentication?

Based on the current StarRocks documentation (as of v3.5),

CREATE USER

is strictly required. There is currently no Just-In-Time (JIT) provisioning or "auto-create user" feature for OIDC/OAuth 2.0. Every user who intends to log in via OIDC must have a corresponding user object already existing in StarRocks. This is because StarRocks needs a local identity to map roles and permissions to. How to simplify the process While you cannot skip user creation entirely, you can make it much simpler by avoiding repeating the OIDC configuration for every user: 1. Configure Global Defaults: Add your OIDC/OAuth 2.0 provider details (like

client_id

,

jwks_url

,

auth_server_url

, etc.) to your

fe.conf

file. 2. Simplified SQL: Once the defaults are in your configuration, you only need to run a single command to "enable" a user for OIDC:

sql
    CREATE USER 'username' IDENTIFIED WITH authentication_oauth2;

_Note: The

username

must match the value in the

principal_field

(usually the

sub

or

email

claim) provided by your Identity Provider (IdP)._ Managing Many Users If you have a large number of users, the current recommended approach is to: * Use a script or orchestration tool to sync users from your IdP to StarRocks via SQL. * Use Security Integrations to manage the connection settings centrally, making the

CREATE USER

statements cleaner. * Combine OIDC with Group Providers (available in v3.5+) to manage permissions more easily. While you still need to create the users, you can map their external OIDC/LDAP groups to StarRocks roles automatically so you don't have to manage individual grants. For more details, see the official OAuth 2.0 Authentication guide. References • administration/user_privs/authentication/oauth2_authentication.md • administration/user_privs/authentication/security_integration.md • administration/user_privs/group_provider.md References • administration/user_privs/authentication/oauth2_authentication.md • administration/user_privs/authentication/jwt_authentication.md