How does oauth authentication work in starrocks? What group provider should I use when i am using oauth? @Rocky

OAuth 2.0 authentication (introduced in v3.5.0) works by integrating StarRocks with an external Authorization Server (e.g., Keycloak, Okta, or Azure AD) using the standard Authorization Code flow. How OAuth Authentication Works 1. Redirection: When you connect via the Web UI or a supported JDBC driver, the StarRocks FE (coordinator) redirects your browser to the external Authorization Server. 2. Authentication: You log in to the external server using your credentials. 3. Token Exchange: After successful login, the server redirects you back to StarRocks with an authorization code. StarRocks then exchanges this code for a JWT (JSON Web Token). 4. Verification: StarRocks verifies the JWT's signature (using a JWKS URL or local public key) and checks fields like

iss

(issuer) and

aud

(audience). 5. Principal Identification: StarRocks extracts a "username" from the JWT using the

principal_field

(default is

sub

). This username must match the username created in StarRocks (e.g.,

CREATE USER tom IDENTIFIED WITH authentication_oauth2

). Which Group Provider to Use? Currently, StarRocks supports three types of group providers: LDAP, Unix, and File. Crucially, StarRocks does not yet have a native "OAuth Group Provider" that extracts groups directly from JWT claims (like a

groups

claim in the token). Instead, you must use one of the existing providers to "bridge" the identity from the token to actual group memberships: 1. LDAP Group Provider (Recommended): Use this if your OAuth server (like Keycloak or Okta) has a corresponding LDAP/AD interface. StarRocks will take the

principal_field

from the JWT and look it up in LDAP to find the user's groups. 2. File Group Provider: Use this for smaller setups where you can manually maintain a mapping of OAuth usernames to groups in a flat file (e.g.,

admin_group:user_sub_id_1,user_sub_id_2

). 3. Unix Group Provider: Use this if the users authenticated via OAuth also exist as local Unix users on the FE host. Configuration Workflow: 1. Create the Group Provider: Define how to fetch groups (e.g.,

CREATE GROUP PROVIDER my_ldap ...

). 2. Create the Security Integration: Define the OAuth 2.0 properties. 3. Link Them: Use

ALTER SECURITY INTEGRATION

to bind the group provider to your OAuth setup:

sql
    ALTER SECURITY INTEGRATION my_oauth_integration SET
    (
        "group_provider" = "my_ldap_provider",
        "permitted_groups" = "bi_users, data_admins" -- Optional login filter
    );

Once linked, whenever a user logs in via OAuth, StarRocks identifies them by their JWT

sub

and automatically fetches their groups from the associated provider for use in authorization (e.g., in Apache Ranger). References • administration/user_privs/authentication/oauth2_authentication.md • administration/user_privs/group_provider.md • administration/user_privs/authentication/security_integration.md References • administration/user_privs/authentication/jwt_authentication.md • administration/user_privs/group_provider.md • administration/management/FE_configuration.md