LDAP automatic user provisioning #20033

mikeCRL · 2025-07-31T05:28:05Z

Documents the new LDAP automatic user provisioning feature in CockroachDB v25.3 and updates command reference pages to reflect changes to SHOW USERS/ROLES output format.

Key features documented

server.provisioning.ldap.enabled cluster setting
PROVISIONSRC role option format: ldap:<server>
Restrictions on auto-provisioned users (no password changes, immutable PROVISIONSRC role option)
CREATE/SHOW USER/ROLE output: new estimated_last_login_time tracking column, options output now as array: NOLOGIN, FOO → {NOLOGIN,FOO}
User cleanup workflows for AD-removed accounts with PowerShell example

Preview

Changes made

LDAP Documentation

Added preview callout that was needed across all pages

v25.3/ldap-authentication.md:

Added automatic user provisioning option with server.provisioning.ldap.enabled setting
Added recommendation to enable LDAP Authorization before auto-provisioning
Added "Managing auto-provisioned users" section with specific queries to filter by PROVISIONSRC
Added 3-step cleanup process for users removed from Active Directory
Added username validation requirements to prerequisites

v25.3/ldap-authorization.md:

Added advice to create CRDB roles before enabling auto-provisioning

v25.2 LDAP pages:

Added callout pointing to v25.3 for auto-provisioning capabilities
Fixed cross-version references

Release notes

Added 2 bullets to v25.3-rc.1 SQL language changes documenting options array format and new login time column

Command Reference Updates

Updated 21 example SHOW/CREATE USER/ROLE output tables across 6 files to use new array format for options column and add estimated_last_login_time column.

v25.3/create-role, v25.3/create-user, v25.3/show-roles, v25.3/show-users, v25.3/set-vars, v25.3/alter-default-privileges

TODOs

Backport v25.2 changes to v24.3 and v25.1. All three of these versions, which support LDAP functionality, did not receive the new 25.3 enhancements.
Enhancements suggested by Eng reviewer, which may be non-blocking if we need to merge, then iterate:
- Consider adding estimated_last_login_time auditing guidance to security documentation (either
  Security Overview or [Authorization Best Practices](https://www.
  cockroachlabs.com/docs/v22.2/security-reference/authorization#authorization-best-practices),
  and later expanding provisioning coverage further for future JWT support in v25.4
- Add query examples using estimated_last_login_time filtering for identifying dormant users in
  the cleanup/auditing section, since this column was primarily added to support deletion
  queries for inactive accounts

netlify · 2025-07-31T05:28:25Z

✅ Deploy Preview for cockroachdb-api-docs canceled.

Name	Link
🔨 Latest commit	`cdfdd74`
🔍 Latest deploy log	https://app.netlify.com/projects/cockroachdb-api-docs/deploys/68906be3471f270008cc2da3

netlify · 2025-07-31T05:28:27Z

✅ Deploy Preview for cockroachdb-interactivetutorials-docs canceled.

Name	Link
🔨 Latest commit	`cdfdd74`
🔍 Latest deploy log	https://app.netlify.com/projects/cockroachdb-interactivetutorials-docs/deploys/68906be39523b50008080e25

github-actions · 2025-07-31T05:28:32Z

Files changed:

netlify · 2025-07-31T05:37:18Z

❌ Deploy Preview for cockroachdb-docs failed. Why did it fail? →

Name	Link
🔨 Latest commit	`cdfdd74`
🔍 Latest deploy log	https://app.netlify.com/projects/cockroachdb-docs/deploys/68906be3f351c00008492850

…er/role table output examples

souravcrl · 2025-08-01T10:20:04Z

src/current/v25.3/ldap-authentication.md

+
+- Users are created automatically upon successful LDAP authentication.
+- All auto-provisioned users receive a `PROVISIONSRC` role option set to `ldap:<ldap_server>`.
+- The `estimated_last_login_time` is tracked for auditing purposes.


The estimated_last_login_time is tracked for all users now, so not sure if we should additionally mention that the new audit is available in security overview here: https://www.cockroachlabs.com/docs/stable/security-reference/security-overview or as an aside for authorization best practices: https://www.cockroachlabs.com/docs/v22.2/security-reference/authorization#authorization-best-practices. The security overview can also include provisioning I feel because we plan to support JWT based provisioning also from 25.4 onwards. cc: @biplav-crl @pritesh-lahoti

Moving this to an issue for follow-up: DOC-14528.

souravcrl · 2025-08-01T10:20:08Z

src/current/v25.3/ldap-authentication.md

+SELECT * FROM [SHOW USERS] AS u 
+WHERE NOT EXISTS (
+  SELECT 1 FROM unnest(u.options) AS opt 
+  WHERE opt LIKE 'PROVISIONSRC=ldap:%'


Should we also include a filtering via the estimated_last_login_time option. The column was primarily added to be able to support deletion queries for dormant users and would be helpful to add to the auditing/deletion the statement clause

Modified one of the ## Managing auto-provisioned users sections to become ### Last-login tracking for usage and dormancy (in upcoming commit)

souravcrl

Approving this as some of the requested items may not make sense given the feature is under preview for 25.3.

taroface

Overall LGTM with some suggestions/comments. However, v25.2 has broken formatting on the LDAP Authentication page, so please fix before merging!

src/current/_includes/releases/v25.3/v25.3.0-rc.1.md

src/current/v25.2/ldap-authentication.md

taroface · 2025-08-01T15:36:27Z

src/current/v25.3/ldap-authorization.md


-When enabled:
+If LDAP authorization is enabled:


Elsewhere LDAP Authorization is capitalized. We should be consistent.

src/current/v25.3/ldap-authorization.md

taroface · 2025-08-01T15:37:30Z

src/current/v25.3/ldap-authentication.md

@@ -4,15 +4,19 @@ summary: Learn how to configure CockroachDB for user authentication using LDAP-c
 toc: true


A few comments I had on v25.2 should also apply here.

taroface · 2025-08-01T15:39:17Z

src/current/v25.2/ldap-authentication.md

@@ -4,9 +4,13 @@ summary: Learn how to configure CockroachDB for user authentication using LDAP-c
 toc: true


This page is broken on preview. Not sure why but often has to do with a misformatted tag:

Co-authored-by: Ryan Kuo <[email protected]>

Initial updates for LDAP automatic user provisioning

61a8fb3

Additional edits

d3166fd

mikeCRL requested a review from souravcrl July 31, 2025 06:00

mikeCRL added 6 commits July 31, 2025 13:34

Add new options format and estimated_last_login_time column to all us…

fabdfa7

…er/role table output examples

Update release notes

ae1c4e2

Changes from PM/technical review

7e4940c

Fix link

3942aec

Remove code block from admonition to simplify

729b8b8

Fix code block

9cc0fc4

souravcrl reviewed Aug 1, 2025

View reviewed changes

mikeCRL requested a review from taroface August 1, 2025 15:22

souravcrl approved these changes Aug 1, 2025

View reviewed changes

taroface reviewed Aug 1, 2025

View reviewed changes

mikeCRL and others added 5 commits August 4, 2025 01:00

Merge branch 'main' into ldap-user

46d8ac9

Apply suggestions from code review

b9b3f9b

Co-authored-by: Ryan Kuo <[email protected]>

Updates from reviews

d3f679c

Backport 25.2 changes to 25.1, 24.3

eca61b1

Fix anchor links on cluster settings

cdfdd74

		@@ -4,15 +4,19 @@ summary: Learn how to configure CockroachDB for user authentication using LDAP-c
		toc: true

		@@ -4,9 +4,13 @@ summary: Learn how to configure CockroachDB for user authentication using LDAP-c
		toc: true

LDAP automatic user provisioning #20033

Are you sure you want to change the base?

LDAP automatic user provisioning #20033

Conversation

mikeCRL commented Jul 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Key features documented

Preview

Changes made

LDAP Documentation

Release notes

Command Reference Updates

TODOs

Uh oh!

netlify bot commented Jul 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for cockroachdb-api-docs canceled.

Uh oh!

netlify bot commented Jul 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for cockroachdb-interactivetutorials-docs canceled.

Uh oh!

github-actions bot commented Jul 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Files changed:

Uh oh!

netlify bot commented Jul 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

❌ Deploy Preview for cockroachdb-docs failed. Why did it fail? →

Uh oh!

souravcrl Aug 1, 2025

Choose a reason for hiding this comment

Uh oh!

mikeCRL Aug 4, 2025

Choose a reason for hiding this comment

Uh oh!

souravcrl Aug 1, 2025

Choose a reason for hiding this comment

Uh oh!

mikeCRL Aug 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

souravcrl left a comment

Choose a reason for hiding this comment

Uh oh!

taroface left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

taroface Aug 1, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

taroface Aug 1, 2025

Choose a reason for hiding this comment

Uh oh!

taroface Aug 1, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

mikeCRL commented Jul 31, 2025 •

edited

Loading

netlify bot commented Jul 31, 2025 •

edited

Loading

netlify bot commented Jul 31, 2025 •

edited

Loading

github-actions bot commented Jul 31, 2025 •

edited

Loading

netlify bot commented Jul 31, 2025 •

edited

Loading

mikeCRL Aug 4, 2025 •

edited

Loading