http://starrocks.io logo
Join Slack
Powered by
Hi Team, <@U0A71G31CDV> Has anyone successfully au...
# questions-and-troubleshooting
a
Hi Team, @Rocky Has anyone successfully authenticated using JWT while connecting with Azure? I've tried multiple times, but I'm still unable to establish the connection. I'm currently using StarRocks image version 4.0.10, and I've followed the configuration provided below. However, the authentication is not working as expected. Has anyone faced a similar issue or managed to get this working? Any guidance would be appreciated.
Copy code
CREATE SECURITY INTEGRATION entra_jwt PROPERTIES (
    "type"              = "authentication_jwt",
    "jwks_url"          = "<https://login.microsoftonline.com/8f231c2a-23434-34234-4324-5b24afe5e890/discovery/v2.0/keys>",
    "principal_field"   = "sub",
    "required_issuer"   = "<https://login.microsoftonline.com/8f231c2a-23434-34234-4324-5b24afe5e890/v2.0>",
    "required_audience" = "bcaf6e2c-d4wf-df43-fw44-49bvdb42a3f0"
);

ADMIN SET FRONTEND CONFIG ("authentication_chain" = "native,entra_jwt");

CREATE USER '8LjfiaFKUJuebdsnfbdq4fAvUNLLzZgbgj9gcXowGM4' IDENTIFIED WITH authentication_jwt;

GRANT SELECT ON ecommerce_db.* TO USER '8LjfiaFKUJuebdsnfbdq4fAvUNLLzZgbgj9gcXowGM4';
When I try to connect through the API, I encounter an error during authentication.
Copy code
Traceback (most recent call last):
  File "/Desktop/ATest/token_auth.py", line 34, in <module>
    conn = pymysql.connect(
           ^^^^^^^^^^^^^^^^
  File "/Desktop/ATest/.venv/lib/python3.11/site-packages/pymysql/connections.py", line 365, in __init__
    self.connect()
  File "/Desktop/ATest/.venv/lib/python3.11/site-packages/pymysql/connections.py", line 681, in connect
    self._request_authentication()
  File "/Desktop/ATest/.venv/lib/python3.11/site-packages/pymysql/connections.py", line 972, in _request_authentication
    auth_packet = self._process_auth(plugin_name, auth_packet)
                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Desktop/ATest/.venv/lib/python3.11/site-packages/pymysql/connections.py", line 995, in _process_auth
    return handler.authenticate(auth_packet)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Desktop/ATest/token_auth.py", line 31, in authenticate
    return self._conn._read_packet()
           ^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Desktop/ATest/.venv/lib/python3.11/site-packages/pymysql/connections.py", line 782, in _read_packet
    packet.raise_for_error()
  File "/Desktop/ATest/.venv/lib/python3.11/site-packages/pymysql/protocol.py", line 219, in raise_for_error
    err.raise_mysql_exception(self._data)
  File "/Desktop/ATest/.venv/lib/python3.11/site-packages/pymysql/err.py", line 150, in raise_mysql_exception
    raise errorclass(errno, errval)
pymysql.err.OperationalError: (1045, '/opt/starrocks/fe/conf (Is a directory)')
r
It appears you are encountering a configuration mismatch between your Security Integration and the Manual User you created. The specific error 
(1045, '/opt/starrocks/fe/conf (Is a directory)')
occurs because your manually created user is missing the necessary JWT properties. When a user is identified with 
authentication_jwt
but has no associated properties, StarRocks FE attempts to fall back to a local key file. If no path is provided in 
fe.conf
, it may default to the 
fe/conf
directory itself, leading to the "Is a directory" error when it tries to "read" it as a key. Here are the steps to resolve this: 1. Match Authentication Methods In StarRocks, Security Integrations and Manual Users are two different workflows. * Security Integration (Recommended for Azure): Designed to handle users who do not exist in the native user table. StarRocks will dynamically authenticate them based on the 
authentication_chain
. * Manual User: You must explicitly define the JWT properties for that specific user using the 
AS
clause. If you want to keep the manual user, you must modify your 
CREATE USER
statement to include the configuration properties:
Copy code
sql
-- Drop the existing user first
DROP USER '8LjfiaFKUJuebdsnfbdq4fAvUNLLzZgbgj9gcXowGM4';

-- Re-create with the AS property block
CREATE USER '8LjfiaFKUJuebdsnfbdq4fAvUNLLzZgbgj9gcXowGM4' 
IDENTIFIED WITH authentication_jwt AS 
'{
    "jwks_url": "<https://login.microsoftonline.com/8f231c2a-23434-34234-4324-5b24afe5e890/discovery/v2.0/keys>",
    "principal_field": "sub",
    "required_issuer": "<https://login.microsoftonline.com/8f231c2a-23434-34234-4324-5b24afe5e890/v2.0>",
    "required_audience": "bcaf6e2c-d4wf-df43-fw44-49bvdb42a3f0"
}';
2. Remove Angle Brackets (
< >
) In your provided SQL, the URLs are wrapped in angle brackets (e.g., 
"<https://...>"
). These are typically placeholders in documentation. Ensure you remove them in your actual SQL commands. The 
jwks_url
must be a clean URL string: * Wrong: 
"<https://login.microsoftonline.com/...>"
* Correct: 
"<https://login.microsoftonline.com/...>"
If the parser sees the 
<
character, it may fail to recognize the string as a URL and instead treat it as a local file path, contributing to the "Is a directory" or "File not found" errors. 3. Global Configuration (Alternative) If you want all users identified with 
authentication_jwt
to use the same Azure settings without repeating the 
AS
block, you can set these globally in your 
fe.conf
and restart the FE:
Copy code
properties
jwt_jwks_url = <https://login.microsoftonline.com/.../discovery/v2.0/keys>
jwt_principal_field = sub
jwt_required_issuer = <https://login.microsoftonline.com/.../v2.0>
jwt_required_audience = bcaf6e2c-d4wf-df43-fw44-49bvdb42a3f0
Once these are in 
fe.conf
, your original 
CREATE USER ... IDENTIFIED WITH authentication_jwt;
(without the 
AS
block) will work. 4. Verify the 
principal_field
 * Azure 
sub
Claim: By default, Azure's 
sub
claim is a unique GUID. Your username 
'8LjfiaFKUJuebdsnfbdq4fAvUNLLzZgbgj9gcXowGM4'
must exactly match the value of the 
sub
claim inside the JWT token you are sending. * Email/Username: If you prefer to use an email address as the username, change 
principal_field
to 
preferred_username
or 
upn
(depending on your Azure AD token configuration) and ensure the StarRocks username matches that field. 5. Client-Side Note Since you are using 
pymysql
, ensure your script is passing the JWT as the password in the connection string, as standard Python MySQL libraries do not support the specialized 
authentication_openid-connect-client
plugin used by the MySQL 9.2+ CLI. For further debugging, you can check the FE leader log (
fe.log
) which usually contains a more descriptive Java stack trace for authentication failures. References
a
Hi @Rocky, still i'm getting some error while cooceting with starrocks
Copy code
Traceback (most recent call last):
  File "/Users/arun/Desktop/ATest/token_auth.py", line 27, in <module>
    conn = pymysql.connect(
           ^^^^^^^^^^^^^^^^
  File "/Users/arun/Desktop/ATest/.venv/lib/python3.11/site-packages/pymysql/connections.py", line 365, in __init__
    self.connect()
  File "/Users/arun/Desktop/ATest/.venv/lib/python3.11/site-packages/pymysql/connections.py", line 681, in connect
    self._request_authentication()
  File "/Users/arun/Desktop/ATest/.venv/lib/python3.11/site-packages/pymysql/connections.py", line 958, in _request_authentication
    auth_packet = self._read_packet()
                  ^^^^^^^^^^^^^^^^^^^
  File "/Users/arun/Desktop/ATest/.venv/lib/python3.11/site-packages/pymysql/connections.py", line 751, in _read_packet
    packet_header = self._read_bytes(4)
                    ^^^^^^^^^^^^^^^^^^^
  File "/Users/arun/Desktop/ATest/.venv/lib/python3.11/site-packages/pymysql/connections.py", line 805, in _read_bytes
    raise err.OperationalError(
pymysql.err.OperationalError: (2013, 'Lost connection to MySQL server during query')
r
The 2013 "Lost connection" error during the authentication phase typically indicates that the StarRocks FE closed the connection because the handshake failed or timed out. For Azure JWT authentication, this is usually caused by one of the following: 1. SSL/TLS Requirement StarRocks often requires (or is configured to require) SSL for JWT authentication to protect the token. If your FE has 
ssl_force_secure_transport = TRUE
in 
fe.conf
, or if the JWT plugin itself mandates a secure channel, a plain 
pymysql
connection will be dropped immediately. Solution: Update your 
pymysql.connect
to use SSL:
Copy code
python
conn = pymysql.connect(
    host='your_fe_host',
    user='8LjfiaFKUJuebdsnfbdq4fAvUNLLzZgbgj9gcXowGM4',
    password='YOUR_AZURE_JWT_TOKEN_STRING',
    ssl={'ca': '/path/to/ca.pem'} # Or ssl=True to skip validation for testing
)
2. FE Reachability to Azure (JWKS Timeout) When you connect, the StarRocks FE must immediately call the 
jwks_url
to fetch the public keys to verify your token. If the FE node is behind a firewall and cannot reach 
<https://login.microsoftonline.com>
, the authentication process will hang and eventually time out, causing the "Lost connection" error on the client side. Test: Log into your StarRocks FE server and run:
Copy code
bash
curl -I <https://login.microsoftonline.com/8f231c2a-23434-34234-4324-5b24afe5e890/discovery/v2.0/keys>
If this fails or takes too long, you need to open egress traffic to Microsoft or download the JWKS keys to a local file and point 
jwks_url
to that local path. 3. Token Issuer (
iss
) Mismatch Azure AD is very strict about the 
iss
(issuer) claim. * If your token is a v2.0 token, the issuer usually looks like 
<https://login.microsoftonline.com/{tenant_id}/v2.0>
. * If your token is a v1.0 token, the issuer is often 
<https://sts.windows.net/{tenant_id}/>
. If the 
required_issuer
in your 
SECURITY INTEGRATION
does not exactly match (including the trailing slash) the 
iss
claim inside your token, the FE will reject the connection. You can inspect your token at jwt.ms to verify the exact string. 4. Client Compatibility StarRocks documentation notes that for native MySQL clients, version 9.2 or later is required because it uses the 
authentication_openid-connect-client
plugin. 
pymysql
does not support this plugin. While you can sometimes "trick" the system by passing the token as the password, it is highly recommended to check the FE Leader logs (
fe.log
and 
fe.warn.log
). They will contain the specific Java exception (e.g., 
ExpiredJwtException
, 
SignatureException
, or 
UnknownHostException
) explaining exactly why the FE dropped your connection. Summary Checklist: 1. FE Logs: Check 
fe/log/fe.warn.log
for the specific error string. 2. SSL: Ensure 
ssl=True
is set in your Python connection. 3. Issuer: Double-check that your 
required_issuer
matches the 
iss
claim in the token (no extra/missing slashes). 4. Network: Ensure the FE can reach the 
jwks_url
. References • administration/user_privs/authentication/jwt_authentication.md • administration/user_privs/ssl_authentication.md • sql-reference/System_variable.md References • sql-reference/System_variable.md • administration/user_privs/authentication/jwt_authentication.md • administration/management/FE_configuration.md • administration/user_privs/authentication/security_integration.md
Open in Slack
PreviousNext
Powered by