LDAP automatic user provisioning #20033
Conversation
✅ Deploy Preview for cockroachdb-api-docs canceled.
|
✅ Deploy Preview for cockroachdb-interactivetutorials-docs canceled.
|
✅ Netlify Preview
To edit notification comments on pull requests, go to your Netlify project configuration. |
|
|
||
| - Users are created automatically upon successful LDAP authentication. | ||
| - All auto-provisioned users receive a `PROVISIONSRC` role option set to `ldap:<ldap_server>`. | ||
| - The `estimated_last_login_time` is tracked for auditing purposes. |
There was a problem hiding this comment.
The estimated_last_login_time is tracked for all users now, so not sure if we should additionally mention that the new audit is available in security overview here: https://www.cockroachlabs.com/docs/stable/security-reference/security-overview or as an aside for authorization best practices: https://www.cockroachlabs.com/docs/v22.2/security-reference/authorization#authorization-best-practices. The security overview can also include provisioning I feel because we plan to support JWT based provisioning also from 25.4 onwards. cc: @biplav-crl @pritesh-lahoti
There was a problem hiding this comment.
Moving this to an issue for follow-up: DOC-14528.
| SELECT * FROM [SHOW USERS] AS u | ||
| WHERE NOT EXISTS ( | ||
| SELECT 1 FROM unnest(u.options) AS opt | ||
| WHERE opt LIKE 'PROVISIONSRC=ldap:%' |
There was a problem hiding this comment.
Should we also include a filtering via the estimated_last_login_time option. The column was primarily added to be able to support deletion queries for dormant users and would be helpful to add to the auditing/deletion the statement clause
There was a problem hiding this comment.
Modified one of the ## Managing auto-provisioned users sections to become ### Last-login tracking for usage and dormancy (in upcoming commit)
Co-authored-by: Ryan Kuo <[email protected]>
|
@taroface Resolved everything, but I'm saving one consideration—adding role scripting example(s)—for after the release. I do think it would by a worthy addition. TFTR! |
DOC-11247
Documents the new LDAP automatic user provisioning feature in CockroachDB v25.3 and updates command reference pages to reflect changes to
SHOW USERS/ROLESoutput format.Key features documented
server.provisioning.ldap.enabledcluster settingPROVISIONSRCrole option format:ldap:<server>PROVISIONSRCrole option)CREATE/SHOW USER/ROLEoutput: newestimated_last_login_timetracking column, options output now as array:NOLOGIN, FOO→{NOLOGIN,FOO}Preview
Changes made
LDAP Documentation
v25.3/ldap-authentication.md:
server.provisioning.ldap.enabledsettingPROVISIONSRCv25.3/ldap-authorization.md:
v25.2 LDAP pages:
Release notes
Command Reference Updates
Updated 21 example SHOW/CREATE USER/ROLE output tables across 6 files to use new array format for
optionscolumn and addestimated_last_login_timecolumn.TODOs
Security Overview or [Authorization Best Practices](https://www.
cockroachlabs.com/docs/v22.2/security-reference/authorization#authorization-best-practices),
and later expanding provisioning coverage further for future JWT support in v25.4
estimated_last_login_timefiltering for identifying dormant users inthe cleanup/auditing section, since this column was primarily added to support deletion
queries for inactive accounts