LDAP + SSH user account with group mapping from LDAP
#88.864 aberto em 21 de out. de 2025
Métricas do repositório
- Stars
- (47.419 stars)
- Métricas de merge de PR
- (Mesclagem média 2d 2h) (1.000 fundiu PRs em 30d)
Description
Company or project name
No response
Use case
Clickhouse is used by clients with varying operating systems. These users often need access to the native client interface. Given that the clickhouse-client tool is currently only available for Linux nodes, SSH access is a good alternative given its cross platform availability.
In an enterprise environment, where access is configured using directory groups, its essential to allow grants using groups made available from such directories during login.
Currently, only LDAP login type allows such group mapping.
In order to allow users from different OS'es to login and use the benefits of directory group mapping, it would be helpful to have users created using multiple-auth methods to get group mappings.
Describe the solution you'd like
CREATE USER 'ldap_user_name' IDENTIFIED WITH ldap SERVER 'MY_AD_LDAP', ssh_key BY KEY 'XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX' TYPE 'ssh-ed25519
If above user created using both LDAP and SSH can login and get LDAP group mappings, that would allow flexibility for users of all OSes.
Describe alternatives you've considered
Only alternative is to statically define grants for users.
Additional context
No response