@Rocky authentication chain native->ldap->oauth2.0 and why it fails user which should be succeded via oauth2.0 with error "[42000][5208] Access denied; No authentication was successful in the authentication chain : [si_ldap_tt: ldap search matched user count 0]"

The error occurs because StarRocks does not support combining OAuth 2.0 with other security integrations (like LDAP) in the

authentication_chain

. According to the official documentation:

"You can specify multiple security integrations in

authentication_chain

except for OAuth 2.0 security integration. *You cannot specify multiple OAuth 2.0 security integrations or one with other security integrations.*"

Why it fails 1. Configuration Restriction: When you configure an

authentication_chain

like

ldap_integration, oauth_integration

, the system either ignores the OAuth integration or the chain fails to process correctly because this combination is explicitly disallowed. 2. Chain Termination: The error message

[si_ldap_tt: ldap search matched user count 0]

indicates that the LDAP step was attempted and failed (the user was not found in LDAP). Because of the restriction mentioned above, the chain does not proceed to the OAuth 2.0 step, resulting in the "No authentication was successful" error. 3. Protocol Mismatch: OAuth 2.0 authentication in StarRocks (available from v3.5+) is designed for the Web UI and JDBC drivers using the Authorization Code flow (tokens). Standard MySQL clients (like the

mysql

CLI) typically do not support this flow. If you are using a standard CLI, it will rely on password-based mechanisms (Native or LDAP), which is why the chain might be failing at the LDAP stage. Recommended Solutions * Decouple the Chain: If you want to use OAuth 2.0 via Security Integration, it must be the only security integration in your

authentication_chain

.

sql
    -- Example for OAuth 2.0 only (Native is always checked first implicitly)
    ADMIN SET FRONTEND CONFIG ("authentication_chain" = "your_oauth_integration_name");

* Use Native LDAP for "Native -> LDAP" users: If you need both, you can create specific users in StarRocks and associate them with LDAP. These are treated as "native" users and checked before the chain begins:

sql
    CREATE USER 'username' IDENTIFIED WITH authentication_ldap_simple AS 'uid=username,ou=users,dc=example,dc=com';

Then, set the

authentication_chain

to only include your OAuth 2.0 security integration. This allows specific users to use LDAP while unknown users fall back to the OAuth 2.0 flow. * Check Authorization Requirements: Note that using Security Integrations (LDAP/OAuth/JWT) requires integrating with Apache Ranger for authorization, as StarRocks' native RBAC is currently not supported for users authenticated via security integrations. For more details, see the StarRocks documentation on Authenticate with Security Integration. References • administration/user_privs/authentication/security_integration.md • administration/user_privs/authentication/oauth2_authentication.md • best_practices/authentication_authorization.md