ClickHouse/ClickHouse
Option to associate an LDAP server with the Kerberos realm
Ouverte
#89 773 ouverte le 9 nov. 2025
featurehelp wanted
Métriques du dépôt
- Stars
- (47 419 étoiles)
- Métriques de merge PR
- (Merge moyen 2j 2h) (1 000 PRs mergées en 30 j)
Description
Company or project name
No response
Use case
Passwordless SSO
Describe the solution you'd like
- Add an optional association between the Kerberos realm and an LDAP server name in config.xml.
- When an HTTP request is successfully Kerberos‑authenticated (GSS-SPNEGO) and the mapped user does not exist in any local access storage:
- If the Kerberos config includes
<ldap_server>..., attempt to provision the user using that LDAP server’s configuration (copying what LDAPAccessStorage would do on first successful LDAP auth). - Skip the password/bind verification step (since identity was already proven by Kerberos).
- Retrieve external roles via GSSAPI.
- If the Kerberos config includes
- Create the user with
AuthenticationType::KERBEROS- Optionally also
AuthenticationType::LDAP(if not disabled via config) - If role search requires user bind (i.e. configuration relies on user’s own password) and no password is available, proceed without external roles or (optionally) fall back to GSSAPI or throw.
- Optionally also
Describe alternatives you've considered
No response
Additional context
No response