@Rocky so when we use ldaps as sec integration it encrypts user/pass from starrocks fe to ldap but what about client to starrocks ? what encrypts that connection?

When you use LDAPS for security integration, it ensures the connection between the StarRocks Frontend (FE) and the LDAP server is encrypted. To encrypt the connection between the client (e.g., MySQL client, JDBC) and StarRocks, you need to enable SSL Authentication. Starting from v3.4.1, StarRocks supports SSL-encrypted connections for the MySQL protocol. This is particularly important when using LDAP, as the LDAP authentication flow often requires the client to send the password to the FE (via the

MysqlClearPasswordPlugin

), and SSL ensures this transmission is secure. How to Encrypt the Client-to-StarRocks Connection 1. Configure the Frontend (FE) You must configure the FE to use an SSL certificate. This is done by adding the following parameters to your `fe.conf`:

properties
# Path to your Java Keystore (JKS) containing the certificate and key
ssl_keystore_location = /path/to/starrocks.keystore
ssl_keystore_password = your_keystore_password
ssl_key_password = your_key_password

# (Optional) Force all connections to use SSL
ssl_force_secure_transport = TRUE

2. Configure the Client Once the FE is configured, clients must be told to use SSL: * MySQL Client: SSL is usually enabled by default. If you want to be explicit or provide a CA certificate:

bash
    mysql -u username -p -h <fe_host> --ssl-mode=REQUIRED

* JDBC Driver: Add SSL parameters to your connection string:

properties
    useSSL=true
    verifyServerCertificate=false (or true if you provide the truststore)

Why this is important for LDAP When using LDAP authentication, StarRocks acts as a proxy. The client sends the password to the FE, and the FE then validates it against the LDAP server. Without SSL enabled between the client and StarRocks, the password would be sent over the network in cleartext (even if the FE-to-LDAP connection is encrypted). For more details on setting up the keystore, you can refer to the StarRocks SSL Authentication documentation. References • administration/user_privs/ssl_authentication.md • release_notes/release-3.4.md • administration/management/BE_configuration.md • administration/management/FE_configuration.md • release_notes/release-3.5.md