@Rocky How to set user group based on a claim of a JWT token? Current documentation doesn't mention anything about JWT.

Sorry, I encountered an error while processing your request: 503 UNAVAILABLE. {'error': {'code': 503, 'message': 'Deadline expired before operation could complete.', 'status': 'UNAVAILABLE'}}

@Rocky Try again please!

Currently, StarRocks does not support extracting user groups directly from a specific claim within a JWT token (e.g., a

groups

or

roles

claim). Instead, StarRocks separates authentication (handled by the JWT) from group mapping (handled by a Group Provider). To achieve group-based authorization for JWT-authenticated users, you must use the following workflow: 1. JWT Authentication: The JWT is used to identify the user via the

principal_field

(typically the

sub

claim or a custom field like

preferred_username

). 2. Group Provider: You must configure a separate Group Provider (such as LDAP or a File-based provider) that contains a mapping between that user identity and their groups. 3. Combination: You then associate the Group Provider with your Security Integration (or the individual user). Example Workflow If you want to map a user identified in a JWT to a group, you can use the File Group Provider as a manual workaround: 1. Create a Group File: Create a file (e.g.,

fe/conf/user_groups.txt

) on your FE nodes:

text
    bi_group:user1,user2
    admin_group:user3

2. Create the Group Provider:

sql
    CREATE GROUP PROVIDER my_file_groups
    PROPERTIES (
        "type" = "file",
        "group_file_url" = "file:///path/to/fe/conf/user_groups.txt"
    );

3. Associate with JWT Security Integration:

sql
    ALTER SECURITY INTEGRATION my_jwt_integration SET (
        "group_provider" = "my_file_groups"
    );

When a user logs in via JWT, StarRocks will extract the username from the token and then look up that username in

my_file_groups

to determine their group membership. For more dynamic group mapping, StarRocks recommends integrating with Apache Ranger for authorization, as it can often handle group-based policies more flexibly when combined with external identity sources. For more details, see the official Group Provider and JWT Authentication documentation. References • administration/user_privs/group_provider.md • administration/user_privs/authentication/security_integration.md • administration/management/FE_configuration.md

@Rocky I have hundreds of thousands users and they keep change. Using a file or LDAP is not feasible. Most of users are in a single group. What's the best way to provision group information for them?

As of StarRocks v3.5, there is no native property (such as a

groups_claim

or

groups_field

) to automatically extract user groups from a JWT claim within a

SECURITY INTEGRATION

. StarRocks strictly separates authentication (JWT) from group provisioning (Group Provider). For a scenario with hundreds of thousands of users where LDAP or static files are not feasible, here is the current state and recommended workarounds: 1. The Limitation When using a

SECURITY INTEGRATION

for JWT (which creates "virtual users" in StarRocks), you must use Apache Ranger for authorization. StarRocks native authorization (roles/privileges assigned within StarRocks) is not yet supported for these virtual users. StarRocks only passes group information to Ranger if a

GROUP PROVIDER

is associated with the security integration. Since the only available providers are

ldap

,

file

, and

unix

, you are currently limited by these three sources. 2. Recommended Workarounds A. Use the

public

Group in Apache Ranger (Best for "Single Group" use case) Since you mentioned most users belong to a single group, you can handle this entirely within Apache Ranger: * In Ranger, create policies that grant the required permissions to the group named

public

. * In Ranger's model, every authenticated user automatically belongs to the

public

group. * This requires zero provisioning in StarRocks or external files for the majority of your users. B. Dynamic File Generation (For the "Specific Users" case) For the minority of users who need special permissions (different groups): * Create a File Group Provider. * Instead of managing a massive manual file, use a sidecar script or cron job on the FE nodes to fetch the "special" users from your Identity Provider (IDP) and generate a small StarRocks-compatible group file (e.g.,

special_admins:userA,userB

). * StarRocks will periodically reload this file based on your configuration. Since you only need to list the "exceptions," the file remains small and manageable. C. External Synchronization to LDAP If your IDP (where the JWTs come from) supports syncing users to an LDAP/Active Directory, you can use the LDAP Group Provider. This is the most "enterprise-ready" way to handle hundreds of thousands of users dynamically. Summary of Configuration To associate any provider with your JWT integration:

sql
-- 1. Create the provider (e.g., File for exceptions)
CREATE GROUP PROVIDER my_exceptions 
PROPERTIES (
    "type" = "file",
    "group_file_url" = "file:///path/to/fe/conf/exceptions.txt"
);

-- 2. Associate it with your JWT Security Integration
ALTER SECURITY INTEGRATION your_jwt_integration SET (
    "group_provider" = "my_exceptions"
);

Status Note: There is an active community interest in supporting a

groups_claim

directly in the JWT security integration to simplify this. You may want to check the StarRocks GitHub Issues or Slack for updates on this feature in upcoming versions (v3.6+). References • administration/user_privs/authentication/security_integration.md • administration/user_privs/group_provider.md • administration/user_privs/authorization/ranger_plugin.md References • administration/user_privs/group_provider.md • administration/user_privs/authentication/security_integration.md