[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-cockroachdb-configuring-sso-and-scim":3,"mdc-2nx6og-key":36,"related-org-cockroachdb-configuring-sso-and-scim":3476,"related-repo-cockroachdb-configuring-sso-and-scim":3640},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":22,"repoUrl":23,"updatedAt":24,"license":25,"forks":26,"topics":27,"repo":31,"sourceUrl":34,"mdContent":35},"configuring-sso-and-scim","configure SSO and SCIM for CockroachDB","Configures SSO authentication and SCIM 2.0 provisioning for CockroachDB across four distinct layers — Cloud Console SSO (SAML\u002FOIDC), DB Console SSO (OIDC), SQL\u002FCluster SSO (JWT or LDAP\u002FAD), and SCIM 2.0 automated provisioning. Use when enabling centralized identity management, setting up SSO for compliance, or automating user lifecycle management.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"cockroachdb","CockroachDB","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Fcockroachdb.png",[12,16,19],{"name":13,"slug":14,"type":15},"Security","security","tag",{"name":17,"slug":18,"type":15},"Auth","auth",{"name":20,"slug":21,"type":15},"Authentication","authentication",3,"https:\u002F\u002Fgithub.com\u002Fcockroachdb\u002Fclaude-plugin","2026-07-12T07:56:52.421289",null,2,[28,29,8,30],"claude","cockroach-cloud","developer-tools",{"repoUrl":23,"stars":22,"forks":26,"topics":32,"description":33},[28,29,8,30],"CockroachDB development plugin for Claude","https:\u002F\u002Fgithub.com\u002Fcockroachdb\u002Fclaude-plugin\u002Ftree\u002FHEAD\u002Fskills\u002Fcockroachdb-security-and-governance\u002Fconfiguring-sso-and-scim","---\nname: configuring-sso-and-scim\ndescription: Configures SSO authentication and SCIM 2.0 provisioning for CockroachDB across four distinct layers — Cloud Console SSO (SAML\u002FOIDC), DB Console SSO (OIDC), SQL\u002FCluster SSO (JWT or LDAP\u002FAD), and SCIM 2.0 automated provisioning. Use when enabling centralized identity management, setting up SSO for compliance, or automating user lifecycle management.\ncompatibility: Requires CockroachDB Cloud organization admin for Console SSO\u002FSCIM. Requires cluster admin for DB Console and SQL SSO configuration. DB Console SSO requires Advanced or Enterprise plan (not available on Standard\u002FBasic). LDAP\u002FAD authentication is self-hosted only (not available on CockroachDB Cloud). SCIM 2.0 requires Enterprise plan.\nmetadata:\n  author: cockroachdb\n  version: \"2.0\"\n---\n\n# Configuring SSO and SCIM\n\nConfigures Single Sign-On (SSO) and SCIM 2.0 provisioning for CockroachDB across four distinct layers:\n\n1. **Cloud Console SSO** — SAML or OIDC for the CockroachDB Cloud web console\n2. **DB Console SSO** — OIDC for the DB Console web UI (Advanced\u002FEnterprise only)\n3. **SQL\u002FCluster SSO** — JWT-based or LDAP\u002FAD authentication for SQL client connections\n4. **SCIM 2.0** — Automated user provisioning on the Cloud Console\n\n## Prerequisites\n\n- **Console SSO\u002FSCIM:** Organization Admin + `ccloud` CLI\n- **DB Console\u002FSQL SSO:** Cluster admin role + Advanced or Enterprise plan (DB Console SSO not on Standard\u002FBasic)\n- **LDAP\u002FAD:** Self-hosted only (not available on CockroachDB Cloud)\n- **SCIM 2.0:** Enterprise plan required\n\n## Configuration Decisions\n\nBefore proceeding, determine which layers the user needs. Ask which of the following apply, then follow only the relevant Parts below.\n\n**Decision 1 — Cloud Console SSO:**\n- **SAML:** Best for enterprise IdPs with existing SAML infrastructure (Okta, Azure AD, PingOne)\n- **OIDC:** Simpler setup, supports Google Workspace and modern IdPs natively\n- **Skip:** Not needed\n\n**Decision 2 — DB Console SSO:**\n- **Enable (OIDC):** SSO for the DB Console web UI. Requires Advanced or Enterprise plan — not available on Standard or Basic\n- **Skip:** Not needed or plan does not support it\n\n**Decision 3 — SQL\u002FCluster SSO method:**\n- **JWT-based:** Cloud-native approach using JWT tokens for SQL client connections. Works on both CockroachDB Cloud and self-hosted clusters\n- **LDAP\u002FAD:** Direct directory authentication against Active Directory or OpenLDAP. Self-hosted only (not available on CockroachDB Cloud)\n- **Skip:** Not needed\n\n**Decision 4 — SCIM 2.0 provisioning:**\n- **Enable:** Automates user lifecycle (create\u002Fupdate\u002Fdeactivate) between IdP and Cloud Console. Requires Enterprise plan\n- **Skip:** Manage Cloud Console users manually\n\n## Steps\n\n### Part 1: Cloud Console SSO\n\nCloud Console SSO enables SAML or OIDC authentication for the CockroachDB Cloud web console.\n\n#### 1.1 Check Current SSO Configuration\n\nCheck SSO status in the Cloud Console UI (Organization Settings > Authentication).\n\n#### 1.2a Configure SAML SSO\n\nFollow this section if the user selected **SAML** in Decision 1.\n\n1. Navigate to **Organization Settings > Authentication** in the Cloud Console\n2. Select **SAML** as the SSO provider type\n3. Configure the SAML connection:\n   - Enter the IdP metadata URL or upload the metadata XML\n   - Copy the CockroachDB Cloud **ACS URL** and **Entity ID** to your IdP\n   - Map IdP attributes to CockroachDB Cloud user fields (email, name)\n4. In your IdP, create a SAML 2.0 application:\n   - Set the **Single sign-on URL** to the CockroachDB Cloud ACS URL\n   - Set the **Audience URI (SP Entity ID)** to the CockroachDB Cloud Entity ID\n   - Set **Name ID format** to Email Address\n   - Map attributes: `email`, `firstName`, `lastName`\n5. Assign users or groups to the SAML application in the IdP\n\nSee [configuration steps reference](references\u002Fconfiguration-steps.md) for IdP-specific SAML instructions (Okta, Azure AD).\n\n#### 1.2b Configure OIDC SSO\n\nFollow this section if the user selected **OIDC** in Decision 1.\n\n1. Navigate to **Organization Settings > Authentication** in the Cloud Console\n2. Select **OIDC** as the SSO provider type\n3. Configure the OIDC connection:\n   - Enter the OIDC discovery URL from your IdP (e.g., `https:\u002F\u002Faccounts.google.com\u002F.well-known\u002Fopenid-configuration`)\n   - Enter the **Client ID** and **Client Secret** from your IdP\n   - Configure the redirect URI in the IdP to point to CockroachDB Cloud\n4. In your IdP, create an OIDC\u002FOAuth 2.0 application:\n   - Set **Sign-in redirect URI** to the CockroachDB Cloud redirect URI\n   - Grant scopes: `openid`, `profile`, `email`\n5. Assign users or groups to the OIDC application in the IdP\n\nSee [configuration steps reference](references\u002Fconfiguration-steps.md) for IdP-specific OIDC instructions (Okta, Azure AD, Google Workspace).\n\n#### 1.3 Test SSO Login\n\n1. Open a new browser session (or incognito window)\n2. Navigate to the CockroachDB Cloud Console login page\n3. Select **Sign in with SSO**\n4. Verify redirect to IdP, authenticate, and redirect back to Cloud Console\n\n#### 1.4 Enforce SSO (Disable Password Login)\n\nAfter verifying SSO works:\n\n1. Navigate to **Organization Settings > Authentication**\n2. Enable **Require SSO** to disable password-based login\n3. Confirm a break-glass admin account exists (see Safety Considerations)\n\n### Part 2: DB Console SSO (OIDC)\n\n> **This configures SSO for the DB Console web UI only, NOT for SQL client connections.** SQL client SSO is configured separately in Part 3 (JWT) or Part 4 (LDAP\u002FAD).\n\n> **Prerequisite:** Advanced or Enterprise plan required. DB Console SSO is not available on Standard or Basic plans.\n\nDB Console SSO uses OIDC to authenticate users to the CockroachDB DB Console web interface.\n\n#### 2.1 Check Current DB Console SSO Configuration\n\n```sql\nSHOW CLUSTER SETTING server.oidc_authentication.enabled;\nSHOW CLUSTER SETTING server.oidc_authentication.provider_url;\nSHOW CLUSTER SETTING server.oidc_authentication.client_id;\n```\n\n#### 2.2 Configure DB Console SSO\n\n```sql\n-- Enable OIDC authentication for the DB Console\nSET CLUSTER SETTING server.oidc_authentication.enabled = true;\n\n-- Set the OIDC provider URL (your IdP's discovery endpoint)\nSET CLUSTER SETTING server.oidc_authentication.provider_url = 'https:\u002F\u002Fyour-idp.example.com';\n\n-- Set the client ID registered in your IdP\nSET CLUSTER SETTING server.oidc_authentication.client_id = '\u003Cclient-id>';\n\n-- Set the client secret\nSET CLUSTER SETTING server.oidc_authentication.client_secret = '\u003Cclient-secret>';\n\n-- Configure the claim field used for username mapping\nSET CLUSTER SETTING server.oidc_authentication.claim_json_key = 'email';\n\n-- Configure the principal regex (extract username from claim)\nSET CLUSTER SETTING server.oidc_authentication.principal_regex = '^([^@]+)';\n```\n\nSee [configuration steps reference](references\u002Fconfiguration-steps.md) for IdP-specific DB Console SSO setup (Okta, Azure AD).\n\n#### 2.3 Test DB Console SSO\n\n1. Open the DB Console URL in a browser\n2. Click **Log in with OIDC**\n3. Authenticate with your IdP\n4. Verify you are logged into the DB Console\n\n### Part 3: SQL\u002FCluster SSO (JWT)\n\nSQL\u002FCluster SSO uses JWT tokens from an IdP to authenticate SQL client connections. This is separate from DB Console SSO (Part 2) — it authenticates `cockroach sql` and application connections, not the web UI.\n\n#### 3.1 Check Current JWT SSO Configuration\n\n```sql\nSHOW CLUSTER SETTING server.jwt_authentication.enabled;\nSHOW CLUSTER SETTING server.jwt_authentication.issuers.configuration;\nSHOW CLUSTER SETTING server.jwt_authentication.jwks_auto_fetch.enabled;\n```\n\n#### 3.2 Configure JWT Authentication\n\n```sql\n-- Enable JWT authentication for SQL connections\nSET CLUSTER SETTING server.jwt_authentication.enabled = true;\n\n-- Configure the JWT issuer(s)\n-- Format: JSON object with issuer URL and audience\nSET CLUSTER SETTING server.jwt_authentication.issuers.configuration = '{\n  \"issuers\": [\n    {\n      \"issuer\": \"https:\u002F\u002Fyour-idp.example.com\",\n      \"audience\": \"\u003Cclient-id>\"\n    }\n  ]\n}';\n\n-- Enable automatic JWKS fetching (recommended)\nSET CLUSTER SETTING server.jwt_authentication.jwks_auto_fetch.enabled = true;\n\n-- Configure the claim used for SQL username mapping\nSET CLUSTER SETTING server.jwt_authentication.claim = 'email';\n```\n\nSee [configuration steps reference](references\u002Fconfiguration-steps.md) for IdP-specific JWT configuration (Okta, Azure AD, Google).\n\n#### 3.3 Configure Identity Mapping\n\nMap IdP identities (e.g., email addresses) to SQL usernames:\n\n```sql\n-- Map user@example.com -> user (strip domain)\nSET CLUSTER SETTING server.identity_map.configuration = '\ncrdb \u002F^(.*)@example\\.com$ \\1\n';\n```\n\n#### 3.4 Enable Auto User Provisioning (Optional)\n\nAuto-provision SQL users when they first authenticate via JWT:\n\n```sql\nSET CLUSTER SETTING security.provisioning.jwt.enabled = true;\n```\n\nWhen enabled, a SQL user is automatically created for authenticated JWT users who do not yet have an account.\n\n#### 3.5 Test SQL\u002FCluster SSO\n\n```bash\n# Obtain a JWT token from your IdP (method varies by IdP)\n# Then connect using the token as the password with JWT auth enabled\ncockroach sql --url \"postgresql:\u002F\u002F\u003Cusername>@\u003Ccluster-host>:26257\u002Fdefaultdb?sslmode=verify-full&options=--crdb:jwt_auth_enabled=true\" --external-io-implicit-credentials\n```\n\nThe JWT token is passed as the password. The `--crdb:jwt_auth_enabled=true` connection option tells CockroachDB to treat the password as a JWT token.\n\n```sql\n-- Verify the connection\nSELECT current_user();\n```\n\n### Part 4: LDAP\u002FAD Authentication\n\nLDAP\u002FAD authentication validates SQL credentials directly against an LDAP directory (Active Directory or OpenLDAP). **Self-hosted only** — not available on CockroachDB Cloud.\n\n> **WARNING — HBA first-match-wins:** HBA rules are evaluated top-to-bottom. The first matching rule is used. A rule like `host all all all ldap ...` matches ALL users from ALL addresses and will prevent password fallback for any user. **Always scope LDAP rules to specific users or roles** to avoid locking out admin accounts.\n\n#### 4.1 Check Current HBA Configuration\n\n```sql\nSHOW CLUSTER SETTING server.host_based_authentication.configuration;\n```\n\n#### 4.2 Configure LDAP Authentication via HBA\n\nLDAP authentication is configured through HBA (Host-Based Authentication) rules. **Always scope LDAP rules** to specific databases or users — never use `host all all all ldap`.\n\n```sql\n-- Configure HBA for LDAP authentication scoped to specific users\n-- The 'root' user and other admin users keep password auth\nSET CLUSTER SETTING server.host_based_authentication.configuration = '\nhost all root all password\nhost all admin_user all password\nhost all all all ldap \"ldapserver=ldap.example.com\" \"ldapport=389\" \"ldapbasedn=dc=example,dc=com\" \"ldapsearchattribute=uid\" \"ldapsearchfilter=(objectClass=inetOrgPerson)\" \"ldapbinddn=cn=readonly,dc=example,dc=com\" \"ldapbindpasswd=\u003Cbind-password>\"\nhost all all all password\n';\n```\n\nKey LDAP HBA parameters:\n- `ldapserver` — LDAP server hostname\n- `ldapport` — LDAP server port (389 for LDAP, 636 for LDAPS)\n- `ldapbasedn` — Base DN for user search\n- `ldapsearchattribute` — Attribute matching the SQL username (e.g., `uid` for OpenLDAP, `sAMAccountName` for AD)\n- `ldapsearchfilter` — **Required.** LDAP filter to narrow the user search (e.g., `(objectClass=inetOrgPerson)`)\n- `ldapbinddn` — DN of the service account used for LDAP bind\u002Fsearch\n- `ldapbindpasswd` — Password for the bind DN service account\n\n> **Important:** Each HBA option must be quoted as `\"key=value\"` (the entire key=value pair in one set of quotes).\n\nSee [configuration steps reference](references\u002Fconfiguration-steps.md) for Active Directory, OpenLDAP, group mapping, and LDAPS examples.\n\n#### 4.3 Use LDAPS (TLS) for Production\n\nFor production environments, always use LDAPS (LDAP over TLS on port 636) to encrypt credentials in transit. Do NOT use `ldaptls=1` — this option is not supported. Instead, use port 636 and configure the custom CA certificate:\n\n```sql\n-- Configure the LDAP CA certificate for TLS verification\nSET CLUSTER SETTING server.ldap_authentication.domain.custom_ca = '-----BEGIN CERTIFICATE-----\n\u003Cyour-ldap-ca-certificate-pem>\n-----END CERTIFICATE-----';\n\n-- Set HBA to use LDAPS (port 636)\nSET CLUSTER SETTING server.host_based_authentication.configuration = '\nhost all root all password\nhost all admin_user all password\nhost all all all ldap \"ldapserver=ldap.example.com\" \"ldapport=636\" \"ldapbasedn=dc=example,dc=com\" \"ldapsearchattribute=uid\" \"ldapsearchfilter=(objectClass=inetOrgPerson)\" \"ldapbinddn=cn=readonly,dc=example,dc=com\" \"ldapbindpasswd=\u003Cbind-password>\"\nhost all all all password\n';\n```\n\n#### 4.4 Configure LDAP Group-to-Role Mapping\n\nLDAP group mapping assigns CockroachDB SQL roles based on LDAP\u002FAD group membership. Group mapping is configured via the `ldapgrouplistfilter` HBA parameter — not via cluster settings.\n\n```sql\n-- HBA with group-to-role mapping\nSET CLUSTER SETTING server.host_based_authentication.configuration = '\nhost all root all password\nhost all admin_user all password\nhost all all all ldap \"ldapserver=ad.corp.example.com\" \"ldapport=636\" \"ldapbasedn=ou=Users,dc=corp,dc=example,dc=com\" \"ldapsearchattribute=sAMAccountName\" \"ldapsearchfilter=(objectClass=user)\" \"ldapbinddn=cn=crdb-svc,ou=ServiceAccounts,dc=corp,dc=example,dc=com\" \"ldapbindpasswd=\u003Cservice-account-password>\" \"ldapgrouplistfilter=(&(objectClass=group)(member={{.User.DN}}))\"\nhost all all all password\n';\n```\n\nThe LDAP group CN is mapped directly to a SQL role name. The role must already exist in CockroachDB:\n\n```sql\nCREATE ROLE IF NOT EXISTS db_admins;\nGRANT admin TO db_admins;\n```\n\n#### 4.5 Enable Auto User Provisioning (Optional)\n\nAuto-provision SQL users when they first authenticate via LDAP:\n\n```sql\nSET CLUSTER SETTING security.provisioning.ldap.enabled = true;\n```\n\n#### 4.6 Test LDAP Authentication\n\n```bash\n# Test with an LDAP user credential\ncockroach sql --url \"postgresql:\u002F\u002F\u003Cldap-username>:\u003Cldap-password>@\u003Ccluster-host>:26257\u002Fdefaultdb?sslmode=verify-full\"\n```\n\n```sql\n-- Verify the user connected successfully\nSELECT current_user();\n\n-- If group mapping is enabled, verify role grants\nSHOW GRANTS FOR \u003Cldap-username>;\n```\n\n### Part 5: SCIM 2.0 on Cloud Console\n\n> **Skip this section** if the user does not need automated user provisioning or does not have an Enterprise plan.\n\nSCIM 2.0 enables automated user provisioning and deprovisioning on the Cloud Console, syncing user lifecycle with your IdP.\n\n#### 5.1 Check Current SCIM Configuration\n\nCheck SCIM status in the Cloud Console UI (Organization Settings > Authentication > SCIM). The `ccloud` CLI does not currently expose SCIM configuration commands.\n\n#### 5.2 Enable SCIM Endpoint\n\n1. Navigate to **Organization Settings > Authentication > SCIM** in the Cloud Console\n2. Enable the SCIM 2.0 endpoint\n3. Copy the **SCIM base URL** and **Bearer token** for IdP configuration\n\n#### 5.3 Configure IdP for SCIM\n\nIn your IdP (Okta, Azure AD, etc.):\n\n1. Add a new SCIM provisioning integration\n2. Enter the SCIM base URL from step 5.2\n3. Enter the Bearer token for authentication\n4. Configure provisioning actions:\n   - **Create users** — New IdP users are created in CockroachDB Cloud\n   - **Update user attributes** — Name and email changes sync\n   - **Deactivate users** — Removed IdP users are deactivated in CockroachDB Cloud\n5. Assign users or groups to the SCIM integration\n\nSee [configuration steps reference](references\u002Fconfiguration-steps.md) for IdP-specific SCIM setup.\n\n#### 5.4 Verify SCIM Provisioning\n\n1. Create a test user in your IdP and assign them to the SCIM integration\n2. Check the Cloud Console — the user should appear within a few minutes\n3. Remove the test user from the IdP SCIM assignment\n4. Verify the user is deactivated in the Cloud Console\n\n## Troubleshooting\n\n### SSO Lockout Recovery\n\nIf SSO is enforced and the IdP becomes unavailable or misconfigured:\n\n1. **Use the break-glass account:** Log in with the pre-configured password-based admin account\n2. **Disable SSO enforcement:** Navigate to Organization Settings > Authentication and disable \"Require SSO\"\n3. **If no break-glass account exists:** Contact CockroachDB Cloud support to disable SSO enforcement for your organization\n\n**Prevention:** Always create and test a break-glass admin account before enforcing SSO.\n\n### JWT Authentication Errors\n\n**\"ERROR: JWT authentication: invalid token\"**\n- Verify the JWT issuer configuration in `server.jwt_authentication.issuers.configuration`\n- Check that the JWT token has not expired\n- Verify that `server.jwt_authentication.jwks_auto_fetch.enabled` is `true`\n- Inspect the token contents: `echo '\u003Ctoken>' | cut -d. -f2 | base64 -d | jq .`\n- Verify the `aud` (audience) claim in the token matches the configured audience\n\n**\"ERROR: JWT authentication: issuer not configured\"**\n- The issuer URL in the token does not match `server.jwt_authentication.issuers.configuration`\n- Re-check the issuer URL matches exactly (trailing slashes matter)\n\n### DB Console OIDC Errors\n\n**\"OIDC: unable to match principal\"**\n- The `server.oidc_authentication.principal_regex` does not match the claim value from the token\n- Test the regex against the actual claim value:\n\n```sql\nSHOW CLUSTER SETTING server.oidc_authentication.principal_regex;\n-- Common patterns:\n-- Email -> username (strip domain): '^([^@]+)'\n-- Full email as username: '^(.+)$'\n```\n\n**Complex regex not accepted:**\n- CockroachDB uses Go's `regexp` syntax (no lookaheads\u002Flookbehinds)\n- Test at https:\u002F\u002Fregex101.com\u002F with the \"Golang\" flavor\n\n### LDAP Authentication Errors\n\n**\"ERROR: LDAP authentication: unable to bind\"**\n- Verify `ldapbinddn` and `ldapbindpasswd` are correct\n- Check that the bind service account has read access to the user search base\n- Test with: `ldapsearch -H ldap:\u002F\u002Fldap.example.com -D \"cn=readonly,dc=example,dc=com\" -W -b \"dc=example,dc=com\" \"(uid=testuser)\"`\n\n**\"ERROR: LDAP authentication: user not found\"**\n- Verify `ldapbasedn` includes the OU where the user resides\n- Check that `ldapsearchattribute` matches the login attribute (`uid` for OpenLDAP, `sAMAccountName` for AD)\n- **Check that `ldapsearchfilter` is set** — without it, LDAP user search will fail\n\n**LDAP lockout — all users blocked**\n- This happens when an overly broad HBA rule like `host all all all ldap ...` is the first rule and the LDAP server is unreachable, or the LDAP config is wrong\n- **Fix:** Ensure `root` and admin users have explicit `password` rules BEFORE any `ldap` rule\n- **Recovery:** Connect as `root` using client certificate auth (bypasses HBA) and fix the HBA configuration\n\n**LDAP server unreachable**\n- Verify network connectivity from CockroachDB nodes to the LDAP server\n- For LDAPS, ensure the CA certificate is configured via `server.ldap_authentication.domain.custom_ca`\n- Check firewall rules for port 389 (LDAP) or 636 (LDAPS)\n\n### Azure AD \u002F Entra ID Specific Issues\n\n**Token audience mismatch:**\n- Azure AD tokens include an `aud` claim that must match the configured audience\n- For JWT SQL SSO: ensure the audience in `server.jwt_authentication.issuers.configuration` matches\n- For DB Console OIDC: ensure `server.oidc_authentication.client_id` matches\n\n**Multi-tenant vs single-tenant:**\n- For single-tenant: use `https:\u002F\u002Flogin.microsoftonline.com\u002F\u003Ctenant-id>\u002Fv2.0` as the issuer\n- For multi-tenant: use `https:\u002F\u002Flogin.microsoftonline.com\u002Fcommon\u002Fv2.0` (requires additional validation)\n\n### Missing ldapsearchfilter\n\nIf LDAP authentication fails with \"user not found\" errors but the user exists in the directory, check whether `ldapsearchfilter` is included in the HBA rule. This parameter is required and without it the LDAP search may fail silently or return no results.\n\n## Safety Considerations\n\n**SSO misconfiguration can lock out users.** If SSO is enforced and the IdP is down or misconfigured, no one can log in.\n\n**Mitigation — Break-glass account:**\n1. Before enforcing SSO, ensure at least one organization admin account uses password authentication\n2. Document the break-glass account credentials in a secure vault (e.g., 1Password, HashiCorp Vault)\n3. Test the break-glass account periodically to ensure it still works\n4. For SQL SSO (JWT or LDAP), keep at least one SQL user with password authentication as a fallback\n\n**HBA first-match-wins — lockout risk:**\nHBA rules are evaluated top-to-bottom. The first matching rule wins. This means:\n- `host all all all ldap ...` as the first rule will force ALL users through LDAP — including `root`\n- If the LDAP server goes down, ALL authentication fails (including admin access)\n- **Always place password rules for `root` and admin users BEFORE LDAP rules**\n\nExample of a dangerous configuration:\n```\n# DANGEROUS — locks out root if LDAP is unavailable\nhost all all all ldap ...\nhost all all all password\n```\n\nSafe configuration:\n```\n# SAFE — root and admins always have password fallback\nhost all root all password\nhost all admin_user all password\nhost all all all ldap ...\nhost all all all password\n```\n\n**SCIM risks:**\n- **Mass deprovisioning:** If the IdP SCIM assignment is accidentally removed, all provisioned users may be deactivated. Start with a small group before enabling for the full organization.\n- **Attribute mapping errors:** Incorrect attribute mapping can create users with wrong names or emails. Test with a single user first.\n\n**LDAP\u002FAD risks:**\n- **LDAP server unavailability blocks authentication:** If the LDAP server is down, users authenticating via LDAP cannot connect. Always keep password-based fallback HBA rules for admin users.\n- **Use a restricted service account for LDAP bind:** The `ldapbinddn` account should have minimal read-only permissions. Never use a domain admin account.\n- **Credential exposure without LDAPS:** LDAP without TLS transmits passwords in cleartext. Always use LDAPS (port 636) with `server.ldap_authentication.domain.custom_ca` in production.\n\n## Rollback\n\n### Disable Cloud Console SSO Enforcement\n\n1. Log in with the break-glass admin account\n2. Navigate to **Organization Settings > Authentication**\n3. Disable **Require SSO** to re-enable password login\n\n### Disable DB Console SSO (OIDC)\n\n```sql\nSET CLUSTER SETTING server.oidc_authentication.enabled = false;\n```\n\n### Disable SQL\u002FCluster SSO (JWT)\n\n```sql\nSET CLUSTER SETTING server.jwt_authentication.enabled = false;\n```\n\n### Disable LDAP\u002FAD Authentication\n\n```sql\n-- Revert HBA to password-only authentication\nSET CLUSTER SETTING server.host_based_authentication.configuration = '\nhost all all all password\n';\n```\n\n### Disable Auto User Provisioning\n\n```sql\n-- Disable JWT auto-provisioning\nSET CLUSTER SETTING security.provisioning.jwt.enabled = false;\n\n-- Disable LDAP auto-provisioning\nSET CLUSTER SETTING security.provisioning.ldap.enabled = false;\n```\n\n### Disable SCIM\n\n1. Navigate to **Organization Settings > Authentication > SCIM**\n2. Disable the SCIM endpoint\n3. Remove the SCIM integration from your IdP\n\n### Remove Identity Mapping\n\n```sql\nSET CLUSTER SETTING server.identity_map.configuration = '';\n```\n\n## References\n\n**Skill references:**\n- [IdP configuration steps](references\u002Fconfiguration-steps.md)\n\n**Related skills:**\n- [auditing-cloud-cluster-security](..\u002Fauditing-cloud-cluster-security\u002FSKILL.md) — Run a full security posture audit\n- [enforcing-password-policies](..\u002Fenforcing-password-policies\u002FSKILL.md) — Strengthen password policies as an alternative to SSO\n- [managing-tls-certificates](..\u002Fmanaging-tls-certificates\u002FSKILL.md) — Certificate-based authentication as an alternative to SSO\n\n**Official CockroachDB Documentation:**\n- [Cloud Console SSO](https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fcockroachcloud\u002Fcloud-org-sso.html)\n- [DB Console SSO](https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fstable\u002Fsso-db-console.html)\n- [Cluster SSO (JWT)](https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fstable\u002Fsso-sql.html)\n- [SCIM Provisioning](https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fcockroachcloud\u002Fconfigure-scim-provisioning)\n- [Cluster Settings](https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fstable\u002Fcluster-settings.html)\n- [HBA Configuration](https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fstable\u002Fsecurity-reference\u002Fauthentication.html)\n- [JWT Authentication](https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fstable\u002Fsso-sql.html)\n- [LDAP Authentication](https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fstable\u002Fldap-authentication)\n- [Authentication Reference](https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fstable\u002Fsecurity-reference\u002Fauthentication)\n",{"data":37,"body":41},{"name":4,"description":6,"compatibility":38,"metadata":39},"Requires CockroachDB Cloud organization admin for Console SSO\u002FSCIM. Requires cluster admin for DB Console and SQL SSO configuration. DB Console SSO requires Advanced or Enterprise plan (not available on Standard\u002FBasic). LDAP\u002FAD authentication is self-hosted only (not available on CockroachDB Cloud). SCIM 2.0 requires Enterprise plan.",{"author":8,"version":40},"2.0",{"type":42,"children":43},"root",[44,52,58,104,111,164,170,175,183,216,224,246,254,284,292,314,320,327,332,339,344,350,362,499,513,519,529,642,652,658,685,691,696,724,730,744,757,762,768,806,812,966,976,982,1010,1016,1029,1035,1066,1072,1230,1240,1246,1251,1290,1296,1301,1315,1320,1326,1393,1406,1429,1435,1447,1475,1481,1495,1501,1521,1591,1596,1706,1727,1737,1743,1756,1853,1859,1872,1930,1935,1958,1964,1969,1983,1989,2033,2078,2084,2097,2102,2108,2120,2126,2162,2168,2173,2234,2244,2250,2273,2279,2285,2290,2323,2333,2339,2347,2409,2417,2435,2441,2449,2470,2509,2517,2547,2553,2561,2598,2606,2660,2668,2733,2741,2765,2771,2779,2818,2826,2855,2861,2873,2879,2889,2897,2920,2930,2968,2973,2983,2988,2997,3005,3028,3036,3083,3089,3095,3122,3128,3142,3148,3162,3168,3204,3210,3256,3262,3283,3289,3303,3309,3317,3328,3336,3372,3380,3470],{"type":45,"tag":46,"props":47,"children":48},"element","h1",{"id":4},[49],{"type":50,"value":51},"text","Configuring SSO and SCIM",{"type":45,"tag":53,"props":54,"children":55},"p",{},[56],{"type":50,"value":57},"Configures Single Sign-On (SSO) and SCIM 2.0 provisioning for CockroachDB across four distinct layers:",{"type":45,"tag":59,"props":60,"children":61},"ol",{},[62,74,84,94],{"type":45,"tag":63,"props":64,"children":65},"li",{},[66,72],{"type":45,"tag":67,"props":68,"children":69},"strong",{},[70],{"type":50,"value":71},"Cloud Console SSO",{"type":50,"value":73}," — SAML or OIDC for the CockroachDB Cloud web console",{"type":45,"tag":63,"props":75,"children":76},{},[77,82],{"type":45,"tag":67,"props":78,"children":79},{},[80],{"type":50,"value":81},"DB Console SSO",{"type":50,"value":83}," — OIDC for the DB Console web UI (Advanced\u002FEnterprise only)",{"type":45,"tag":63,"props":85,"children":86},{},[87,92],{"type":45,"tag":67,"props":88,"children":89},{},[90],{"type":50,"value":91},"SQL\u002FCluster SSO",{"type":50,"value":93}," — JWT-based or LDAP\u002FAD authentication for SQL client connections",{"type":45,"tag":63,"props":95,"children":96},{},[97,102],{"type":45,"tag":67,"props":98,"children":99},{},[100],{"type":50,"value":101},"SCIM 2.0",{"type":50,"value":103}," — Automated user provisioning on the Cloud Console",{"type":45,"tag":105,"props":106,"children":108},"h2",{"id":107},"prerequisites",[109],{"type":50,"value":110},"Prerequisites",{"type":45,"tag":112,"props":113,"children":114},"ul",{},[115,134,144,154],{"type":45,"tag":63,"props":116,"children":117},{},[118,123,125,132],{"type":45,"tag":67,"props":119,"children":120},{},[121],{"type":50,"value":122},"Console SSO\u002FSCIM:",{"type":50,"value":124}," Organization Admin + ",{"type":45,"tag":126,"props":127,"children":129},"code",{"className":128},[],[130],{"type":50,"value":131},"ccloud",{"type":50,"value":133}," CLI",{"type":45,"tag":63,"props":135,"children":136},{},[137,142],{"type":45,"tag":67,"props":138,"children":139},{},[140],{"type":50,"value":141},"DB Console\u002FSQL SSO:",{"type":50,"value":143}," Cluster admin role + Advanced or Enterprise plan (DB Console SSO not on Standard\u002FBasic)",{"type":45,"tag":63,"props":145,"children":146},{},[147,152],{"type":45,"tag":67,"props":148,"children":149},{},[150],{"type":50,"value":151},"LDAP\u002FAD:",{"type":50,"value":153}," Self-hosted only (not available on CockroachDB Cloud)",{"type":45,"tag":63,"props":155,"children":156},{},[157,162],{"type":45,"tag":67,"props":158,"children":159},{},[160],{"type":50,"value":161},"SCIM 2.0:",{"type":50,"value":163}," Enterprise plan required",{"type":45,"tag":105,"props":165,"children":167},{"id":166},"configuration-decisions",[168],{"type":50,"value":169},"Configuration Decisions",{"type":45,"tag":53,"props":171,"children":172},{},[173],{"type":50,"value":174},"Before proceeding, determine which layers the user needs. Ask which of the following apply, then follow only the relevant Parts below.",{"type":45,"tag":53,"props":176,"children":177},{},[178],{"type":45,"tag":67,"props":179,"children":180},{},[181],{"type":50,"value":182},"Decision 1 — Cloud Console SSO:",{"type":45,"tag":112,"props":184,"children":185},{},[186,196,206],{"type":45,"tag":63,"props":187,"children":188},{},[189,194],{"type":45,"tag":67,"props":190,"children":191},{},[192],{"type":50,"value":193},"SAML:",{"type":50,"value":195}," Best for enterprise IdPs with existing SAML infrastructure (Okta, Azure AD, PingOne)",{"type":45,"tag":63,"props":197,"children":198},{},[199,204],{"type":45,"tag":67,"props":200,"children":201},{},[202],{"type":50,"value":203},"OIDC:",{"type":50,"value":205}," Simpler setup, supports Google Workspace and modern IdPs natively",{"type":45,"tag":63,"props":207,"children":208},{},[209,214],{"type":45,"tag":67,"props":210,"children":211},{},[212],{"type":50,"value":213},"Skip:",{"type":50,"value":215}," Not needed",{"type":45,"tag":53,"props":217,"children":218},{},[219],{"type":45,"tag":67,"props":220,"children":221},{},[222],{"type":50,"value":223},"Decision 2 — DB Console SSO:",{"type":45,"tag":112,"props":225,"children":226},{},[227,237],{"type":45,"tag":63,"props":228,"children":229},{},[230,235],{"type":45,"tag":67,"props":231,"children":232},{},[233],{"type":50,"value":234},"Enable (OIDC):",{"type":50,"value":236}," SSO for the DB Console web UI. Requires Advanced or Enterprise plan — not available on Standard or Basic",{"type":45,"tag":63,"props":238,"children":239},{},[240,244],{"type":45,"tag":67,"props":241,"children":242},{},[243],{"type":50,"value":213},{"type":50,"value":245}," Not needed or plan does not support it",{"type":45,"tag":53,"props":247,"children":248},{},[249],{"type":45,"tag":67,"props":250,"children":251},{},[252],{"type":50,"value":253},"Decision 3 — SQL\u002FCluster SSO method:",{"type":45,"tag":112,"props":255,"children":256},{},[257,267,276],{"type":45,"tag":63,"props":258,"children":259},{},[260,265],{"type":45,"tag":67,"props":261,"children":262},{},[263],{"type":50,"value":264},"JWT-based:",{"type":50,"value":266}," Cloud-native approach using JWT tokens for SQL client connections. Works on both CockroachDB Cloud and self-hosted clusters",{"type":45,"tag":63,"props":268,"children":269},{},[270,274],{"type":45,"tag":67,"props":271,"children":272},{},[273],{"type":50,"value":151},{"type":50,"value":275}," Direct directory authentication against Active Directory or OpenLDAP. Self-hosted only (not available on CockroachDB Cloud)",{"type":45,"tag":63,"props":277,"children":278},{},[279,283],{"type":45,"tag":67,"props":280,"children":281},{},[282],{"type":50,"value":213},{"type":50,"value":215},{"type":45,"tag":53,"props":285,"children":286},{},[287],{"type":45,"tag":67,"props":288,"children":289},{},[290],{"type":50,"value":291},"Decision 4 — SCIM 2.0 provisioning:",{"type":45,"tag":112,"props":293,"children":294},{},[295,305],{"type":45,"tag":63,"props":296,"children":297},{},[298,303],{"type":45,"tag":67,"props":299,"children":300},{},[301],{"type":50,"value":302},"Enable:",{"type":50,"value":304}," Automates user lifecycle (create\u002Fupdate\u002Fdeactivate) between IdP and Cloud Console. Requires Enterprise plan",{"type":45,"tag":63,"props":306,"children":307},{},[308,312],{"type":45,"tag":67,"props":309,"children":310},{},[311],{"type":50,"value":213},{"type":50,"value":313}," Manage Cloud Console users manually",{"type":45,"tag":105,"props":315,"children":317},{"id":316},"steps",[318],{"type":50,"value":319},"Steps",{"type":45,"tag":321,"props":322,"children":324},"h3",{"id":323},"part-1-cloud-console-sso",[325],{"type":50,"value":326},"Part 1: Cloud Console SSO",{"type":45,"tag":53,"props":328,"children":329},{},[330],{"type":50,"value":331},"Cloud Console SSO enables SAML or OIDC authentication for the CockroachDB Cloud web console.",{"type":45,"tag":333,"props":334,"children":336},"h4",{"id":335},"_11-check-current-sso-configuration",[337],{"type":50,"value":338},"1.1 Check Current SSO Configuration",{"type":45,"tag":53,"props":340,"children":341},{},[342],{"type":50,"value":343},"Check SSO status in the Cloud Console UI (Organization Settings > Authentication).",{"type":45,"tag":333,"props":345,"children":347},{"id":346},"_12a-configure-saml-sso",[348],{"type":50,"value":349},"1.2a Configure SAML SSO",{"type":45,"tag":53,"props":351,"children":352},{},[353,355,360],{"type":50,"value":354},"Follow this section if the user selected ",{"type":45,"tag":67,"props":356,"children":357},{},[358],{"type":50,"value":359},"SAML",{"type":50,"value":361}," in Decision 1.",{"type":45,"tag":59,"props":363,"children":364},{},[365,377,388,425,494],{"type":45,"tag":63,"props":366,"children":367},{},[368,370,375],{"type":50,"value":369},"Navigate to ",{"type":45,"tag":67,"props":371,"children":372},{},[373],{"type":50,"value":374},"Organization Settings > Authentication",{"type":50,"value":376}," in the Cloud Console",{"type":45,"tag":63,"props":378,"children":379},{},[380,382,386],{"type":50,"value":381},"Select ",{"type":45,"tag":67,"props":383,"children":384},{},[385],{"type":50,"value":359},{"type":50,"value":387}," as the SSO provider type",{"type":45,"tag":63,"props":389,"children":390},{},[391,393],{"type":50,"value":392},"Configure the SAML connection:\n",{"type":45,"tag":112,"props":394,"children":395},{},[396,401,420],{"type":45,"tag":63,"props":397,"children":398},{},[399],{"type":50,"value":400},"Enter the IdP metadata URL or upload the metadata XML",{"type":45,"tag":63,"props":402,"children":403},{},[404,406,411,413,418],{"type":50,"value":405},"Copy the CockroachDB Cloud ",{"type":45,"tag":67,"props":407,"children":408},{},[409],{"type":50,"value":410},"ACS URL",{"type":50,"value":412}," and ",{"type":45,"tag":67,"props":414,"children":415},{},[416],{"type":50,"value":417},"Entity ID",{"type":50,"value":419}," to your IdP",{"type":45,"tag":63,"props":421,"children":422},{},[423],{"type":50,"value":424},"Map IdP attributes to CockroachDB Cloud user fields (email, name)",{"type":45,"tag":63,"props":426,"children":427},{},[428,430],{"type":50,"value":429},"In your IdP, create a SAML 2.0 application:\n",{"type":45,"tag":112,"props":431,"children":432},{},[433,445,456,468],{"type":45,"tag":63,"props":434,"children":435},{},[436,438,443],{"type":50,"value":437},"Set the ",{"type":45,"tag":67,"props":439,"children":440},{},[441],{"type":50,"value":442},"Single sign-on URL",{"type":50,"value":444}," to the CockroachDB Cloud ACS URL",{"type":45,"tag":63,"props":446,"children":447},{},[448,449,454],{"type":50,"value":437},{"type":45,"tag":67,"props":450,"children":451},{},[452],{"type":50,"value":453},"Audience URI (SP Entity ID)",{"type":50,"value":455}," to the CockroachDB Cloud Entity ID",{"type":45,"tag":63,"props":457,"children":458},{},[459,461,466],{"type":50,"value":460},"Set ",{"type":45,"tag":67,"props":462,"children":463},{},[464],{"type":50,"value":465},"Name ID format",{"type":50,"value":467}," to Email Address",{"type":45,"tag":63,"props":469,"children":470},{},[471,473,479,481,487,488],{"type":50,"value":472},"Map attributes: ",{"type":45,"tag":126,"props":474,"children":476},{"className":475},[],[477],{"type":50,"value":478},"email",{"type":50,"value":480},", ",{"type":45,"tag":126,"props":482,"children":484},{"className":483},[],[485],{"type":50,"value":486},"firstName",{"type":50,"value":480},{"type":45,"tag":126,"props":489,"children":491},{"className":490},[],[492],{"type":50,"value":493},"lastName",{"type":45,"tag":63,"props":495,"children":496},{},[497],{"type":50,"value":498},"Assign users or groups to the SAML application in the IdP",{"type":45,"tag":53,"props":500,"children":501},{},[502,504,511],{"type":50,"value":503},"See ",{"type":45,"tag":505,"props":506,"children":508},"a",{"href":507},"references\u002Fconfiguration-steps.md",[509],{"type":50,"value":510},"configuration steps reference",{"type":50,"value":512}," for IdP-specific SAML instructions (Okta, Azure AD).",{"type":45,"tag":333,"props":514,"children":516},{"id":515},"_12b-configure-oidc-sso",[517],{"type":50,"value":518},"1.2b Configure OIDC SSO",{"type":45,"tag":53,"props":520,"children":521},{},[522,523,528],{"type":50,"value":354},{"type":45,"tag":67,"props":524,"children":525},{},[526],{"type":50,"value":527},"OIDC",{"type":50,"value":361},{"type":45,"tag":59,"props":530,"children":531},{},[532,541,550,594,637],{"type":45,"tag":63,"props":533,"children":534},{},[535,536,540],{"type":50,"value":369},{"type":45,"tag":67,"props":537,"children":538},{},[539],{"type":50,"value":374},{"type":50,"value":376},{"type":45,"tag":63,"props":542,"children":543},{},[544,545,549],{"type":50,"value":381},{"type":45,"tag":67,"props":546,"children":547},{},[548],{"type":50,"value":527},{"type":50,"value":387},{"type":45,"tag":63,"props":551,"children":552},{},[553,555],{"type":50,"value":554},"Configure the OIDC connection:\n",{"type":45,"tag":112,"props":556,"children":557},{},[558,571,589],{"type":45,"tag":63,"props":559,"children":560},{},[561,563,569],{"type":50,"value":562},"Enter the OIDC discovery URL from your IdP (e.g., ",{"type":45,"tag":126,"props":564,"children":566},{"className":565},[],[567],{"type":50,"value":568},"https:\u002F\u002Faccounts.google.com\u002F.well-known\u002Fopenid-configuration",{"type":50,"value":570},")",{"type":45,"tag":63,"props":572,"children":573},{},[574,576,581,582,587],{"type":50,"value":575},"Enter the ",{"type":45,"tag":67,"props":577,"children":578},{},[579],{"type":50,"value":580},"Client ID",{"type":50,"value":412},{"type":45,"tag":67,"props":583,"children":584},{},[585],{"type":50,"value":586},"Client Secret",{"type":50,"value":588}," from your IdP",{"type":45,"tag":63,"props":590,"children":591},{},[592],{"type":50,"value":593},"Configure the redirect URI in the IdP to point to CockroachDB Cloud",{"type":45,"tag":63,"props":595,"children":596},{},[597,599],{"type":50,"value":598},"In your IdP, create an OIDC\u002FOAuth 2.0 application:\n",{"type":45,"tag":112,"props":600,"children":601},{},[602,613],{"type":45,"tag":63,"props":603,"children":604},{},[605,606,611],{"type":50,"value":460},{"type":45,"tag":67,"props":607,"children":608},{},[609],{"type":50,"value":610},"Sign-in redirect URI",{"type":50,"value":612}," to the CockroachDB Cloud redirect URI",{"type":45,"tag":63,"props":614,"children":615},{},[616,618,624,625,631,632],{"type":50,"value":617},"Grant scopes: ",{"type":45,"tag":126,"props":619,"children":621},{"className":620},[],[622],{"type":50,"value":623},"openid",{"type":50,"value":480},{"type":45,"tag":126,"props":626,"children":628},{"className":627},[],[629],{"type":50,"value":630},"profile",{"type":50,"value":480},{"type":45,"tag":126,"props":633,"children":635},{"className":634},[],[636],{"type":50,"value":478},{"type":45,"tag":63,"props":638,"children":639},{},[640],{"type":50,"value":641},"Assign users or groups to the OIDC application in the IdP",{"type":45,"tag":53,"props":643,"children":644},{},[645,646,650],{"type":50,"value":503},{"type":45,"tag":505,"props":647,"children":648},{"href":507},[649],{"type":50,"value":510},{"type":50,"value":651}," for IdP-specific OIDC instructions (Okta, Azure AD, Google Workspace).",{"type":45,"tag":333,"props":653,"children":655},{"id":654},"_13-test-sso-login",[656],{"type":50,"value":657},"1.3 Test SSO Login",{"type":45,"tag":59,"props":659,"children":660},{},[661,666,671,680],{"type":45,"tag":63,"props":662,"children":663},{},[664],{"type":50,"value":665},"Open a new browser session (or incognito window)",{"type":45,"tag":63,"props":667,"children":668},{},[669],{"type":50,"value":670},"Navigate to the CockroachDB Cloud Console login page",{"type":45,"tag":63,"props":672,"children":673},{},[674,675],{"type":50,"value":381},{"type":45,"tag":67,"props":676,"children":677},{},[678],{"type":50,"value":679},"Sign in with SSO",{"type":45,"tag":63,"props":681,"children":682},{},[683],{"type":50,"value":684},"Verify redirect to IdP, authenticate, and redirect back to Cloud Console",{"type":45,"tag":333,"props":686,"children":688},{"id":687},"_14-enforce-sso-disable-password-login",[689],{"type":50,"value":690},"1.4 Enforce SSO (Disable Password Login)",{"type":45,"tag":53,"props":692,"children":693},{},[694],{"type":50,"value":695},"After verifying SSO works:",{"type":45,"tag":59,"props":697,"children":698},{},[699,707,719],{"type":45,"tag":63,"props":700,"children":701},{},[702,703],{"type":50,"value":369},{"type":45,"tag":67,"props":704,"children":705},{},[706],{"type":50,"value":374},{"type":45,"tag":63,"props":708,"children":709},{},[710,712,717],{"type":50,"value":711},"Enable ",{"type":45,"tag":67,"props":713,"children":714},{},[715],{"type":50,"value":716},"Require SSO",{"type":50,"value":718}," to disable password-based login",{"type":45,"tag":63,"props":720,"children":721},{},[722],{"type":50,"value":723},"Confirm a break-glass admin account exists (see Safety Considerations)",{"type":45,"tag":321,"props":725,"children":727},{"id":726},"part-2-db-console-sso-oidc",[728],{"type":50,"value":729},"Part 2: DB Console SSO (OIDC)",{"type":45,"tag":731,"props":732,"children":733},"blockquote",{},[734],{"type":45,"tag":53,"props":735,"children":736},{},[737,742],{"type":45,"tag":67,"props":738,"children":739},{},[740],{"type":50,"value":741},"This configures SSO for the DB Console web UI only, NOT for SQL client connections.",{"type":50,"value":743}," SQL client SSO is configured separately in Part 3 (JWT) or Part 4 (LDAP\u002FAD).",{"type":45,"tag":731,"props":745,"children":746},{},[747],{"type":45,"tag":53,"props":748,"children":749},{},[750,755],{"type":45,"tag":67,"props":751,"children":752},{},[753],{"type":50,"value":754},"Prerequisite:",{"type":50,"value":756}," Advanced or Enterprise plan required. DB Console SSO is not available on Standard or Basic plans.",{"type":45,"tag":53,"props":758,"children":759},{},[760],{"type":50,"value":761},"DB Console SSO uses OIDC to authenticate users to the CockroachDB DB Console web interface.",{"type":45,"tag":333,"props":763,"children":765},{"id":764},"_21-check-current-db-console-sso-configuration",[766],{"type":50,"value":767},"2.1 Check Current DB Console SSO Configuration",{"type":45,"tag":769,"props":770,"children":775},"pre",{"className":771,"code":772,"language":773,"meta":774,"style":774},"language-sql shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","SHOW CLUSTER SETTING server.oidc_authentication.enabled;\nSHOW CLUSTER SETTING server.oidc_authentication.provider_url;\nSHOW CLUSTER SETTING server.oidc_authentication.client_id;\n","sql","",[776],{"type":45,"tag":126,"props":777,"children":778},{"__ignoreMap":774},[779,790,798],{"type":45,"tag":780,"props":781,"children":784},"span",{"class":782,"line":783},"line",1,[785],{"type":45,"tag":780,"props":786,"children":787},{},[788],{"type":50,"value":789},"SHOW CLUSTER SETTING server.oidc_authentication.enabled;\n",{"type":45,"tag":780,"props":791,"children":792},{"class":782,"line":26},[793],{"type":45,"tag":780,"props":794,"children":795},{},[796],{"type":50,"value":797},"SHOW CLUSTER SETTING server.oidc_authentication.provider_url;\n",{"type":45,"tag":780,"props":799,"children":800},{"class":782,"line":22},[801],{"type":45,"tag":780,"props":802,"children":803},{},[804],{"type":50,"value":805},"SHOW CLUSTER SETTING server.oidc_authentication.client_id;\n",{"type":45,"tag":333,"props":807,"children":809},{"id":808},"_22-configure-db-console-sso",[810],{"type":50,"value":811},"2.2 Configure DB Console SSO",{"type":45,"tag":769,"props":813,"children":815},{"className":771,"code":814,"language":773,"meta":774,"style":774},"-- Enable OIDC authentication for the DB Console\nSET CLUSTER SETTING server.oidc_authentication.enabled = true;\n\n-- Set the OIDC provider URL (your IdP's discovery endpoint)\nSET CLUSTER SETTING server.oidc_authentication.provider_url = 'https:\u002F\u002Fyour-idp.example.com';\n\n-- Set the client ID registered in your IdP\nSET CLUSTER SETTING server.oidc_authentication.client_id = '\u003Cclient-id>';\n\n-- Set the client secret\nSET CLUSTER SETTING server.oidc_authentication.client_secret = '\u003Cclient-secret>';\n\n-- Configure the claim field used for username mapping\nSET CLUSTER SETTING server.oidc_authentication.claim_json_key = 'email';\n\n-- Configure the principal regex (extract username from claim)\nSET CLUSTER SETTING server.oidc_authentication.principal_regex = '^([^@]+)';\n",[816],{"type":45,"tag":126,"props":817,"children":818},{"__ignoreMap":774},[819,827,835,844,853,862,870,879,888,896,905,914,922,931,940,948,957],{"type":45,"tag":780,"props":820,"children":821},{"class":782,"line":783},[822],{"type":45,"tag":780,"props":823,"children":824},{},[825],{"type":50,"value":826},"-- Enable OIDC authentication for the DB Console\n",{"type":45,"tag":780,"props":828,"children":829},{"class":782,"line":26},[830],{"type":45,"tag":780,"props":831,"children":832},{},[833],{"type":50,"value":834},"SET CLUSTER SETTING server.oidc_authentication.enabled = true;\n",{"type":45,"tag":780,"props":836,"children":837},{"class":782,"line":22},[838],{"type":45,"tag":780,"props":839,"children":841},{"emptyLinePlaceholder":840},true,[842],{"type":50,"value":843},"\n",{"type":45,"tag":780,"props":845,"children":847},{"class":782,"line":846},4,[848],{"type":45,"tag":780,"props":849,"children":850},{},[851],{"type":50,"value":852},"-- Set the OIDC provider URL (your IdP's discovery endpoint)\n",{"type":45,"tag":780,"props":854,"children":856},{"class":782,"line":855},5,[857],{"type":45,"tag":780,"props":858,"children":859},{},[860],{"type":50,"value":861},"SET CLUSTER SETTING server.oidc_authentication.provider_url = 'https:\u002F\u002Fyour-idp.example.com';\n",{"type":45,"tag":780,"props":863,"children":865},{"class":782,"line":864},6,[866],{"type":45,"tag":780,"props":867,"children":868},{"emptyLinePlaceholder":840},[869],{"type":50,"value":843},{"type":45,"tag":780,"props":871,"children":873},{"class":782,"line":872},7,[874],{"type":45,"tag":780,"props":875,"children":876},{},[877],{"type":50,"value":878},"-- Set the client ID registered in your IdP\n",{"type":45,"tag":780,"props":880,"children":882},{"class":782,"line":881},8,[883],{"type":45,"tag":780,"props":884,"children":885},{},[886],{"type":50,"value":887},"SET CLUSTER SETTING server.oidc_authentication.client_id = '\u003Cclient-id>';\n",{"type":45,"tag":780,"props":889,"children":891},{"class":782,"line":890},9,[892],{"type":45,"tag":780,"props":893,"children":894},{"emptyLinePlaceholder":840},[895],{"type":50,"value":843},{"type":45,"tag":780,"props":897,"children":899},{"class":782,"line":898},10,[900],{"type":45,"tag":780,"props":901,"children":902},{},[903],{"type":50,"value":904},"-- Set the client secret\n",{"type":45,"tag":780,"props":906,"children":908},{"class":782,"line":907},11,[909],{"type":45,"tag":780,"props":910,"children":911},{},[912],{"type":50,"value":913},"SET CLUSTER SETTING server.oidc_authentication.client_secret = '\u003Cclient-secret>';\n",{"type":45,"tag":780,"props":915,"children":917},{"class":782,"line":916},12,[918],{"type":45,"tag":780,"props":919,"children":920},{"emptyLinePlaceholder":840},[921],{"type":50,"value":843},{"type":45,"tag":780,"props":923,"children":925},{"class":782,"line":924},13,[926],{"type":45,"tag":780,"props":927,"children":928},{},[929],{"type":50,"value":930},"-- Configure the claim field used for username mapping\n",{"type":45,"tag":780,"props":932,"children":934},{"class":782,"line":933},14,[935],{"type":45,"tag":780,"props":936,"children":937},{},[938],{"type":50,"value":939},"SET CLUSTER SETTING server.oidc_authentication.claim_json_key = 'email';\n",{"type":45,"tag":780,"props":941,"children":943},{"class":782,"line":942},15,[944],{"type":45,"tag":780,"props":945,"children":946},{"emptyLinePlaceholder":840},[947],{"type":50,"value":843},{"type":45,"tag":780,"props":949,"children":951},{"class":782,"line":950},16,[952],{"type":45,"tag":780,"props":953,"children":954},{},[955],{"type":50,"value":956},"-- Configure the principal regex (extract username from claim)\n",{"type":45,"tag":780,"props":958,"children":960},{"class":782,"line":959},17,[961],{"type":45,"tag":780,"props":962,"children":963},{},[964],{"type":50,"value":965},"SET CLUSTER SETTING server.oidc_authentication.principal_regex = '^([^@]+)';\n",{"type":45,"tag":53,"props":967,"children":968},{},[969,970,974],{"type":50,"value":503},{"type":45,"tag":505,"props":971,"children":972},{"href":507},[973],{"type":50,"value":510},{"type":50,"value":975}," for IdP-specific DB Console SSO setup (Okta, Azure AD).",{"type":45,"tag":333,"props":977,"children":979},{"id":978},"_23-test-db-console-sso",[980],{"type":50,"value":981},"2.3 Test DB Console SSO",{"type":45,"tag":59,"props":983,"children":984},{},[985,990,1000,1005],{"type":45,"tag":63,"props":986,"children":987},{},[988],{"type":50,"value":989},"Open the DB Console URL in a browser",{"type":45,"tag":63,"props":991,"children":992},{},[993,995],{"type":50,"value":994},"Click ",{"type":45,"tag":67,"props":996,"children":997},{},[998],{"type":50,"value":999},"Log in with OIDC",{"type":45,"tag":63,"props":1001,"children":1002},{},[1003],{"type":50,"value":1004},"Authenticate with your IdP",{"type":45,"tag":63,"props":1006,"children":1007},{},[1008],{"type":50,"value":1009},"Verify you are logged into the DB Console",{"type":45,"tag":321,"props":1011,"children":1013},{"id":1012},"part-3-sqlcluster-sso-jwt",[1014],{"type":50,"value":1015},"Part 3: SQL\u002FCluster SSO (JWT)",{"type":45,"tag":53,"props":1017,"children":1018},{},[1019,1021,1027],{"type":50,"value":1020},"SQL\u002FCluster SSO uses JWT tokens from an IdP to authenticate SQL client connections. This is separate from DB Console SSO (Part 2) — it authenticates ",{"type":45,"tag":126,"props":1022,"children":1024},{"className":1023},[],[1025],{"type":50,"value":1026},"cockroach sql",{"type":50,"value":1028}," and application connections, not the web UI.",{"type":45,"tag":333,"props":1030,"children":1032},{"id":1031},"_31-check-current-jwt-sso-configuration",[1033],{"type":50,"value":1034},"3.1 Check Current JWT SSO Configuration",{"type":45,"tag":769,"props":1036,"children":1038},{"className":771,"code":1037,"language":773,"meta":774,"style":774},"SHOW CLUSTER SETTING server.jwt_authentication.enabled;\nSHOW CLUSTER SETTING server.jwt_authentication.issuers.configuration;\nSHOW CLUSTER SETTING server.jwt_authentication.jwks_auto_fetch.enabled;\n",[1039],{"type":45,"tag":126,"props":1040,"children":1041},{"__ignoreMap":774},[1042,1050,1058],{"type":45,"tag":780,"props":1043,"children":1044},{"class":782,"line":783},[1045],{"type":45,"tag":780,"props":1046,"children":1047},{},[1048],{"type":50,"value":1049},"SHOW CLUSTER SETTING server.jwt_authentication.enabled;\n",{"type":45,"tag":780,"props":1051,"children":1052},{"class":782,"line":26},[1053],{"type":45,"tag":780,"props":1054,"children":1055},{},[1056],{"type":50,"value":1057},"SHOW CLUSTER SETTING server.jwt_authentication.issuers.configuration;\n",{"type":45,"tag":780,"props":1059,"children":1060},{"class":782,"line":22},[1061],{"type":45,"tag":780,"props":1062,"children":1063},{},[1064],{"type":50,"value":1065},"SHOW CLUSTER SETTING server.jwt_authentication.jwks_auto_fetch.enabled;\n",{"type":45,"tag":333,"props":1067,"children":1069},{"id":1068},"_32-configure-jwt-authentication",[1070],{"type":50,"value":1071},"3.2 Configure JWT Authentication",{"type":45,"tag":769,"props":1073,"children":1075},{"className":771,"code":1074,"language":773,"meta":774,"style":774},"-- Enable JWT authentication for SQL connections\nSET CLUSTER SETTING server.jwt_authentication.enabled = true;\n\n-- Configure the JWT issuer(s)\n-- Format: JSON object with issuer URL and audience\nSET CLUSTER SETTING server.jwt_authentication.issuers.configuration = '{\n  \"issuers\": [\n    {\n      \"issuer\": \"https:\u002F\u002Fyour-idp.example.com\",\n      \"audience\": \"\u003Cclient-id>\"\n    }\n  ]\n}';\n\n-- Enable automatic JWKS fetching (recommended)\nSET CLUSTER SETTING server.jwt_authentication.jwks_auto_fetch.enabled = true;\n\n-- Configure the claim used for SQL username mapping\nSET CLUSTER SETTING server.jwt_authentication.claim = 'email';\n",[1076],{"type":45,"tag":126,"props":1077,"children":1078},{"__ignoreMap":774},[1079,1087,1095,1102,1110,1118,1126,1134,1142,1150,1158,1166,1174,1182,1189,1197,1205,1212,1221],{"type":45,"tag":780,"props":1080,"children":1081},{"class":782,"line":783},[1082],{"type":45,"tag":780,"props":1083,"children":1084},{},[1085],{"type":50,"value":1086},"-- Enable JWT authentication for SQL connections\n",{"type":45,"tag":780,"props":1088,"children":1089},{"class":782,"line":26},[1090],{"type":45,"tag":780,"props":1091,"children":1092},{},[1093],{"type":50,"value":1094},"SET CLUSTER SETTING server.jwt_authentication.enabled = true;\n",{"type":45,"tag":780,"props":1096,"children":1097},{"class":782,"line":22},[1098],{"type":45,"tag":780,"props":1099,"children":1100},{"emptyLinePlaceholder":840},[1101],{"type":50,"value":843},{"type":45,"tag":780,"props":1103,"children":1104},{"class":782,"line":846},[1105],{"type":45,"tag":780,"props":1106,"children":1107},{},[1108],{"type":50,"value":1109},"-- Configure the JWT issuer(s)\n",{"type":45,"tag":780,"props":1111,"children":1112},{"class":782,"line":855},[1113],{"type":45,"tag":780,"props":1114,"children":1115},{},[1116],{"type":50,"value":1117},"-- Format: JSON object with issuer URL and audience\n",{"type":45,"tag":780,"props":1119,"children":1120},{"class":782,"line":864},[1121],{"type":45,"tag":780,"props":1122,"children":1123},{},[1124],{"type":50,"value":1125},"SET CLUSTER SETTING server.jwt_authentication.issuers.configuration = '{\n",{"type":45,"tag":780,"props":1127,"children":1128},{"class":782,"line":872},[1129],{"type":45,"tag":780,"props":1130,"children":1131},{},[1132],{"type":50,"value":1133},"  \"issuers\": [\n",{"type":45,"tag":780,"props":1135,"children":1136},{"class":782,"line":881},[1137],{"type":45,"tag":780,"props":1138,"children":1139},{},[1140],{"type":50,"value":1141},"    {\n",{"type":45,"tag":780,"props":1143,"children":1144},{"class":782,"line":890},[1145],{"type":45,"tag":780,"props":1146,"children":1147},{},[1148],{"type":50,"value":1149},"      \"issuer\": \"https:\u002F\u002Fyour-idp.example.com\",\n",{"type":45,"tag":780,"props":1151,"children":1152},{"class":782,"line":898},[1153],{"type":45,"tag":780,"props":1154,"children":1155},{},[1156],{"type":50,"value":1157},"      \"audience\": \"\u003Cclient-id>\"\n",{"type":45,"tag":780,"props":1159,"children":1160},{"class":782,"line":907},[1161],{"type":45,"tag":780,"props":1162,"children":1163},{},[1164],{"type":50,"value":1165},"    }\n",{"type":45,"tag":780,"props":1167,"children":1168},{"class":782,"line":916},[1169],{"type":45,"tag":780,"props":1170,"children":1171},{},[1172],{"type":50,"value":1173},"  ]\n",{"type":45,"tag":780,"props":1175,"children":1176},{"class":782,"line":924},[1177],{"type":45,"tag":780,"props":1178,"children":1179},{},[1180],{"type":50,"value":1181},"}';\n",{"type":45,"tag":780,"props":1183,"children":1184},{"class":782,"line":933},[1185],{"type":45,"tag":780,"props":1186,"children":1187},{"emptyLinePlaceholder":840},[1188],{"type":50,"value":843},{"type":45,"tag":780,"props":1190,"children":1191},{"class":782,"line":942},[1192],{"type":45,"tag":780,"props":1193,"children":1194},{},[1195],{"type":50,"value":1196},"-- Enable automatic JWKS fetching (recommended)\n",{"type":45,"tag":780,"props":1198,"children":1199},{"class":782,"line":950},[1200],{"type":45,"tag":780,"props":1201,"children":1202},{},[1203],{"type":50,"value":1204},"SET CLUSTER SETTING server.jwt_authentication.jwks_auto_fetch.enabled = true;\n",{"type":45,"tag":780,"props":1206,"children":1207},{"class":782,"line":959},[1208],{"type":45,"tag":780,"props":1209,"children":1210},{"emptyLinePlaceholder":840},[1211],{"type":50,"value":843},{"type":45,"tag":780,"props":1213,"children":1215},{"class":782,"line":1214},18,[1216],{"type":45,"tag":780,"props":1217,"children":1218},{},[1219],{"type":50,"value":1220},"-- Configure the claim used for SQL username mapping\n",{"type":45,"tag":780,"props":1222,"children":1224},{"class":782,"line":1223},19,[1225],{"type":45,"tag":780,"props":1226,"children":1227},{},[1228],{"type":50,"value":1229},"SET CLUSTER SETTING server.jwt_authentication.claim = 'email';\n",{"type":45,"tag":53,"props":1231,"children":1232},{},[1233,1234,1238],{"type":50,"value":503},{"type":45,"tag":505,"props":1235,"children":1236},{"href":507},[1237],{"type":50,"value":510},{"type":50,"value":1239}," for IdP-specific JWT configuration (Okta, Azure AD, Google).",{"type":45,"tag":333,"props":1241,"children":1243},{"id":1242},"_33-configure-identity-mapping",[1244],{"type":50,"value":1245},"3.3 Configure Identity Mapping",{"type":45,"tag":53,"props":1247,"children":1248},{},[1249],{"type":50,"value":1250},"Map IdP identities (e.g., email addresses) to SQL usernames:",{"type":45,"tag":769,"props":1252,"children":1254},{"className":771,"code":1253,"language":773,"meta":774,"style":774},"-- Map user@example.com -> user (strip domain)\nSET CLUSTER SETTING server.identity_map.configuration = '\ncrdb \u002F^(.*)@example\\.com$ \\1\n';\n",[1255],{"type":45,"tag":126,"props":1256,"children":1257},{"__ignoreMap":774},[1258,1266,1274,1282],{"type":45,"tag":780,"props":1259,"children":1260},{"class":782,"line":783},[1261],{"type":45,"tag":780,"props":1262,"children":1263},{},[1264],{"type":50,"value":1265},"-- Map user@example.com -> user (strip domain)\n",{"type":45,"tag":780,"props":1267,"children":1268},{"class":782,"line":26},[1269],{"type":45,"tag":780,"props":1270,"children":1271},{},[1272],{"type":50,"value":1273},"SET CLUSTER SETTING server.identity_map.configuration = '\n",{"type":45,"tag":780,"props":1275,"children":1276},{"class":782,"line":22},[1277],{"type":45,"tag":780,"props":1278,"children":1279},{},[1280],{"type":50,"value":1281},"crdb \u002F^(.*)@example\\.com$ \\1\n",{"type":45,"tag":780,"props":1283,"children":1284},{"class":782,"line":846},[1285],{"type":45,"tag":780,"props":1286,"children":1287},{},[1288],{"type":50,"value":1289},"';\n",{"type":45,"tag":333,"props":1291,"children":1293},{"id":1292},"_34-enable-auto-user-provisioning-optional",[1294],{"type":50,"value":1295},"3.4 Enable Auto User Provisioning (Optional)",{"type":45,"tag":53,"props":1297,"children":1298},{},[1299],{"type":50,"value":1300},"Auto-provision SQL users when they first authenticate via JWT:",{"type":45,"tag":769,"props":1302,"children":1304},{"className":771,"code":1303,"language":773,"meta":774,"style":774},"SET CLUSTER SETTING security.provisioning.jwt.enabled = true;\n",[1305],{"type":45,"tag":126,"props":1306,"children":1307},{"__ignoreMap":774},[1308],{"type":45,"tag":780,"props":1309,"children":1310},{"class":782,"line":783},[1311],{"type":45,"tag":780,"props":1312,"children":1313},{},[1314],{"type":50,"value":1303},{"type":45,"tag":53,"props":1316,"children":1317},{},[1318],{"type":50,"value":1319},"When enabled, a SQL user is automatically created for authenticated JWT users who do not yet have an account.",{"type":45,"tag":333,"props":1321,"children":1323},{"id":1322},"_35-test-sqlcluster-sso",[1324],{"type":50,"value":1325},"3.5 Test SQL\u002FCluster SSO",{"type":45,"tag":769,"props":1327,"children":1331},{"className":1328,"code":1329,"language":1330,"meta":774,"style":774},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","# Obtain a JWT token from your IdP (method varies by IdP)\n# Then connect using the token as the password with JWT auth enabled\ncockroach sql --url \"postgresql:\u002F\u002F\u003Cusername>@\u003Ccluster-host>:26257\u002Fdefaultdb?sslmode=verify-full&options=--crdb:jwt_auth_enabled=true\" --external-io-implicit-credentials\n","bash",[1332],{"type":45,"tag":126,"props":1333,"children":1334},{"__ignoreMap":774},[1335,1344,1352],{"type":45,"tag":780,"props":1336,"children":1337},{"class":782,"line":783},[1338],{"type":45,"tag":780,"props":1339,"children":1341},{"style":1340},"--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic",[1342],{"type":50,"value":1343},"# Obtain a JWT token from your IdP (method varies by IdP)\n",{"type":45,"tag":780,"props":1345,"children":1346},{"class":782,"line":26},[1347],{"type":45,"tag":780,"props":1348,"children":1349},{"style":1340},[1350],{"type":50,"value":1351},"# Then connect using the token as the password with JWT auth enabled\n",{"type":45,"tag":780,"props":1353,"children":1354},{"class":782,"line":22},[1355,1361,1367,1372,1378,1383,1388],{"type":45,"tag":780,"props":1356,"children":1358},{"style":1357},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[1359],{"type":50,"value":1360},"cockroach",{"type":45,"tag":780,"props":1362,"children":1364},{"style":1363},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[1365],{"type":50,"value":1366}," sql",{"type":45,"tag":780,"props":1368,"children":1369},{"style":1363},[1370],{"type":50,"value":1371}," --url",{"type":45,"tag":780,"props":1373,"children":1375},{"style":1374},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[1376],{"type":50,"value":1377}," \"",{"type":45,"tag":780,"props":1379,"children":1380},{"style":1363},[1381],{"type":50,"value":1382},"postgresql:\u002F\u002F\u003Cusername>@\u003Ccluster-host>:26257\u002Fdefaultdb?sslmode=verify-full&options=--crdb:jwt_auth_enabled=true",{"type":45,"tag":780,"props":1384,"children":1385},{"style":1374},[1386],{"type":50,"value":1387},"\"",{"type":45,"tag":780,"props":1389,"children":1390},{"style":1363},[1391],{"type":50,"value":1392}," --external-io-implicit-credentials\n",{"type":45,"tag":53,"props":1394,"children":1395},{},[1396,1398,1404],{"type":50,"value":1397},"The JWT token is passed as the password. The ",{"type":45,"tag":126,"props":1399,"children":1401},{"className":1400},[],[1402],{"type":50,"value":1403},"--crdb:jwt_auth_enabled=true",{"type":50,"value":1405}," connection option tells CockroachDB to treat the password as a JWT token.",{"type":45,"tag":769,"props":1407,"children":1409},{"className":771,"code":1408,"language":773,"meta":774,"style":774},"-- Verify the connection\nSELECT current_user();\n",[1410],{"type":45,"tag":126,"props":1411,"children":1412},{"__ignoreMap":774},[1413,1421],{"type":45,"tag":780,"props":1414,"children":1415},{"class":782,"line":783},[1416],{"type":45,"tag":780,"props":1417,"children":1418},{},[1419],{"type":50,"value":1420},"-- Verify the connection\n",{"type":45,"tag":780,"props":1422,"children":1423},{"class":782,"line":26},[1424],{"type":45,"tag":780,"props":1425,"children":1426},{},[1427],{"type":50,"value":1428},"SELECT current_user();\n",{"type":45,"tag":321,"props":1430,"children":1432},{"id":1431},"part-4-ldapad-authentication",[1433],{"type":50,"value":1434},"Part 4: LDAP\u002FAD Authentication",{"type":45,"tag":53,"props":1436,"children":1437},{},[1438,1440,1445],{"type":50,"value":1439},"LDAP\u002FAD authentication validates SQL credentials directly against an LDAP directory (Active Directory or OpenLDAP). ",{"type":45,"tag":67,"props":1441,"children":1442},{},[1443],{"type":50,"value":1444},"Self-hosted only",{"type":50,"value":1446}," — not available on CockroachDB Cloud.",{"type":45,"tag":731,"props":1448,"children":1449},{},[1450],{"type":45,"tag":53,"props":1451,"children":1452},{},[1453,1458,1460,1466,1468,1473],{"type":45,"tag":67,"props":1454,"children":1455},{},[1456],{"type":50,"value":1457},"WARNING — HBA first-match-wins:",{"type":50,"value":1459}," HBA rules are evaluated top-to-bottom. The first matching rule is used. A rule like ",{"type":45,"tag":126,"props":1461,"children":1463},{"className":1462},[],[1464],{"type":50,"value":1465},"host all all all ldap ...",{"type":50,"value":1467}," matches ALL users from ALL addresses and will prevent password fallback for any user. ",{"type":45,"tag":67,"props":1469,"children":1470},{},[1471],{"type":50,"value":1472},"Always scope LDAP rules to specific users or roles",{"type":50,"value":1474}," to avoid locking out admin accounts.",{"type":45,"tag":333,"props":1476,"children":1478},{"id":1477},"_41-check-current-hba-configuration",[1479],{"type":50,"value":1480},"4.1 Check Current HBA Configuration",{"type":45,"tag":769,"props":1482,"children":1484},{"className":771,"code":1483,"language":773,"meta":774,"style":774},"SHOW CLUSTER SETTING server.host_based_authentication.configuration;\n",[1485],{"type":45,"tag":126,"props":1486,"children":1487},{"__ignoreMap":774},[1488],{"type":45,"tag":780,"props":1489,"children":1490},{"class":782,"line":783},[1491],{"type":45,"tag":780,"props":1492,"children":1493},{},[1494],{"type":50,"value":1483},{"type":45,"tag":333,"props":1496,"children":1498},{"id":1497},"_42-configure-ldap-authentication-via-hba",[1499],{"type":50,"value":1500},"4.2 Configure LDAP Authentication via HBA",{"type":45,"tag":53,"props":1502,"children":1503},{},[1504,1506,1511,1513,1519],{"type":50,"value":1505},"LDAP authentication is configured through HBA (Host-Based Authentication) rules. ",{"type":45,"tag":67,"props":1507,"children":1508},{},[1509],{"type":50,"value":1510},"Always scope LDAP rules",{"type":50,"value":1512}," to specific databases or users — never use ",{"type":45,"tag":126,"props":1514,"children":1516},{"className":1515},[],[1517],{"type":50,"value":1518},"host all all all ldap",{"type":50,"value":1520},".",{"type":45,"tag":769,"props":1522,"children":1524},{"className":771,"code":1523,"language":773,"meta":774,"style":774},"-- Configure HBA for LDAP authentication scoped to specific users\n-- The 'root' user and other admin users keep password auth\nSET CLUSTER SETTING server.host_based_authentication.configuration = '\nhost all root all password\nhost all admin_user all password\nhost all all all ldap \"ldapserver=ldap.example.com\" \"ldapport=389\" \"ldapbasedn=dc=example,dc=com\" \"ldapsearchattribute=uid\" \"ldapsearchfilter=(objectClass=inetOrgPerson)\" \"ldapbinddn=cn=readonly,dc=example,dc=com\" \"ldapbindpasswd=\u003Cbind-password>\"\nhost all all all password\n';\n",[1525],{"type":45,"tag":126,"props":1526,"children":1527},{"__ignoreMap":774},[1528,1536,1544,1552,1560,1568,1576,1584],{"type":45,"tag":780,"props":1529,"children":1530},{"class":782,"line":783},[1531],{"type":45,"tag":780,"props":1532,"children":1533},{},[1534],{"type":50,"value":1535},"-- Configure HBA for LDAP authentication scoped to specific users\n",{"type":45,"tag":780,"props":1537,"children":1538},{"class":782,"line":26},[1539],{"type":45,"tag":780,"props":1540,"children":1541},{},[1542],{"type":50,"value":1543},"-- The 'root' user and other admin users keep password auth\n",{"type":45,"tag":780,"props":1545,"children":1546},{"class":782,"line":22},[1547],{"type":45,"tag":780,"props":1548,"children":1549},{},[1550],{"type":50,"value":1551},"SET CLUSTER SETTING server.host_based_authentication.configuration = '\n",{"type":45,"tag":780,"props":1553,"children":1554},{"class":782,"line":846},[1555],{"type":45,"tag":780,"props":1556,"children":1557},{},[1558],{"type":50,"value":1559},"host all root all password\n",{"type":45,"tag":780,"props":1561,"children":1562},{"class":782,"line":855},[1563],{"type":45,"tag":780,"props":1564,"children":1565},{},[1566],{"type":50,"value":1567},"host all admin_user all password\n",{"type":45,"tag":780,"props":1569,"children":1570},{"class":782,"line":864},[1571],{"type":45,"tag":780,"props":1572,"children":1573},{},[1574],{"type":50,"value":1575},"host all all all ldap \"ldapserver=ldap.example.com\" \"ldapport=389\" \"ldapbasedn=dc=example,dc=com\" \"ldapsearchattribute=uid\" \"ldapsearchfilter=(objectClass=inetOrgPerson)\" \"ldapbinddn=cn=readonly,dc=example,dc=com\" \"ldapbindpasswd=\u003Cbind-password>\"\n",{"type":45,"tag":780,"props":1577,"children":1578},{"class":782,"line":872},[1579],{"type":45,"tag":780,"props":1580,"children":1581},{},[1582],{"type":50,"value":1583},"host all all all password\n",{"type":45,"tag":780,"props":1585,"children":1586},{"class":782,"line":881},[1587],{"type":45,"tag":780,"props":1588,"children":1589},{},[1590],{"type":50,"value":1289},{"type":45,"tag":53,"props":1592,"children":1593},{},[1594],{"type":50,"value":1595},"Key LDAP HBA parameters:",{"type":45,"tag":112,"props":1597,"children":1598},{},[1599,1610,1621,1632,1659,1684,1695],{"type":45,"tag":63,"props":1600,"children":1601},{},[1602,1608],{"type":45,"tag":126,"props":1603,"children":1605},{"className":1604},[],[1606],{"type":50,"value":1607},"ldapserver",{"type":50,"value":1609}," — LDAP server hostname",{"type":45,"tag":63,"props":1611,"children":1612},{},[1613,1619],{"type":45,"tag":126,"props":1614,"children":1616},{"className":1615},[],[1617],{"type":50,"value":1618},"ldapport",{"type":50,"value":1620}," — LDAP server port (389 for LDAP, 636 for LDAPS)",{"type":45,"tag":63,"props":1622,"children":1623},{},[1624,1630],{"type":45,"tag":126,"props":1625,"children":1627},{"className":1626},[],[1628],{"type":50,"value":1629},"ldapbasedn",{"type":50,"value":1631}," — Base DN for user search",{"type":45,"tag":63,"props":1633,"children":1634},{},[1635,1641,1643,1649,1651,1657],{"type":45,"tag":126,"props":1636,"children":1638},{"className":1637},[],[1639],{"type":50,"value":1640},"ldapsearchattribute",{"type":50,"value":1642}," — Attribute matching the SQL username (e.g., ",{"type":45,"tag":126,"props":1644,"children":1646},{"className":1645},[],[1647],{"type":50,"value":1648},"uid",{"type":50,"value":1650}," for OpenLDAP, ",{"type":45,"tag":126,"props":1652,"children":1654},{"className":1653},[],[1655],{"type":50,"value":1656},"sAMAccountName",{"type":50,"value":1658}," for AD)",{"type":45,"tag":63,"props":1660,"children":1661},{},[1662,1668,1670,1675,1677,1683],{"type":45,"tag":126,"props":1663,"children":1665},{"className":1664},[],[1666],{"type":50,"value":1667},"ldapsearchfilter",{"type":50,"value":1669}," — ",{"type":45,"tag":67,"props":1671,"children":1672},{},[1673],{"type":50,"value":1674},"Required.",{"type":50,"value":1676}," LDAP filter to narrow the user search (e.g., ",{"type":45,"tag":126,"props":1678,"children":1680},{"className":1679},[],[1681],{"type":50,"value":1682},"(objectClass=inetOrgPerson)",{"type":50,"value":570},{"type":45,"tag":63,"props":1685,"children":1686},{},[1687,1693],{"type":45,"tag":126,"props":1688,"children":1690},{"className":1689},[],[1691],{"type":50,"value":1692},"ldapbinddn",{"type":50,"value":1694}," — DN of the service account used for LDAP bind\u002Fsearch",{"type":45,"tag":63,"props":1696,"children":1697},{},[1698,1704],{"type":45,"tag":126,"props":1699,"children":1701},{"className":1700},[],[1702],{"type":50,"value":1703},"ldapbindpasswd",{"type":50,"value":1705}," — Password for the bind DN service account",{"type":45,"tag":731,"props":1707,"children":1708},{},[1709],{"type":45,"tag":53,"props":1710,"children":1711},{},[1712,1717,1719,1725],{"type":45,"tag":67,"props":1713,"children":1714},{},[1715],{"type":50,"value":1716},"Important:",{"type":50,"value":1718}," Each HBA option must be quoted as ",{"type":45,"tag":126,"props":1720,"children":1722},{"className":1721},[],[1723],{"type":50,"value":1724},"\"key=value\"",{"type":50,"value":1726}," (the entire key=value pair in one set of quotes).",{"type":45,"tag":53,"props":1728,"children":1729},{},[1730,1731,1735],{"type":50,"value":503},{"type":45,"tag":505,"props":1732,"children":1733},{"href":507},[1734],{"type":50,"value":510},{"type":50,"value":1736}," for Active Directory, OpenLDAP, group mapping, and LDAPS examples.",{"type":45,"tag":333,"props":1738,"children":1740},{"id":1739},"_43-use-ldaps-tls-for-production",[1741],{"type":50,"value":1742},"4.3 Use LDAPS (TLS) for Production",{"type":45,"tag":53,"props":1744,"children":1745},{},[1746,1748,1754],{"type":50,"value":1747},"For production environments, always use LDAPS (LDAP over TLS on port 636) to encrypt credentials in transit. Do NOT use ",{"type":45,"tag":126,"props":1749,"children":1751},{"className":1750},[],[1752],{"type":50,"value":1753},"ldaptls=1",{"type":50,"value":1755}," — this option is not supported. Instead, use port 636 and configure the custom CA certificate:",{"type":45,"tag":769,"props":1757,"children":1759},{"className":771,"code":1758,"language":773,"meta":774,"style":774},"-- Configure the LDAP CA certificate for TLS verification\nSET CLUSTER SETTING server.ldap_authentication.domain.custom_ca = '-----BEGIN CERTIFICATE-----\n\u003Cyour-ldap-ca-certificate-pem>\n-----END CERTIFICATE-----';\n\n-- Set HBA to use LDAPS (port 636)\nSET CLUSTER SETTING server.host_based_authentication.configuration = '\nhost all root all password\nhost all admin_user all password\nhost all all all ldap \"ldapserver=ldap.example.com\" \"ldapport=636\" \"ldapbasedn=dc=example,dc=com\" \"ldapsearchattribute=uid\" \"ldapsearchfilter=(objectClass=inetOrgPerson)\" \"ldapbinddn=cn=readonly,dc=example,dc=com\" \"ldapbindpasswd=\u003Cbind-password>\"\nhost all all all password\n';\n",[1760],{"type":45,"tag":126,"props":1761,"children":1762},{"__ignoreMap":774},[1763,1771,1779,1787,1795,1802,1810,1817,1824,1831,1839,1846],{"type":45,"tag":780,"props":1764,"children":1765},{"class":782,"line":783},[1766],{"type":45,"tag":780,"props":1767,"children":1768},{},[1769],{"type":50,"value":1770},"-- Configure the LDAP CA certificate for TLS verification\n",{"type":45,"tag":780,"props":1772,"children":1773},{"class":782,"line":26},[1774],{"type":45,"tag":780,"props":1775,"children":1776},{},[1777],{"type":50,"value":1778},"SET CLUSTER SETTING server.ldap_authentication.domain.custom_ca = '-----BEGIN CERTIFICATE-----\n",{"type":45,"tag":780,"props":1780,"children":1781},{"class":782,"line":22},[1782],{"type":45,"tag":780,"props":1783,"children":1784},{},[1785],{"type":50,"value":1786},"\u003Cyour-ldap-ca-certificate-pem>\n",{"type":45,"tag":780,"props":1788,"children":1789},{"class":782,"line":846},[1790],{"type":45,"tag":780,"props":1791,"children":1792},{},[1793],{"type":50,"value":1794},"-----END CERTIFICATE-----';\n",{"type":45,"tag":780,"props":1796,"children":1797},{"class":782,"line":855},[1798],{"type":45,"tag":780,"props":1799,"children":1800},{"emptyLinePlaceholder":840},[1801],{"type":50,"value":843},{"type":45,"tag":780,"props":1803,"children":1804},{"class":782,"line":864},[1805],{"type":45,"tag":780,"props":1806,"children":1807},{},[1808],{"type":50,"value":1809},"-- Set HBA to use LDAPS (port 636)\n",{"type":45,"tag":780,"props":1811,"children":1812},{"class":782,"line":872},[1813],{"type":45,"tag":780,"props":1814,"children":1815},{},[1816],{"type":50,"value":1551},{"type":45,"tag":780,"props":1818,"children":1819},{"class":782,"line":881},[1820],{"type":45,"tag":780,"props":1821,"children":1822},{},[1823],{"type":50,"value":1559},{"type":45,"tag":780,"props":1825,"children":1826},{"class":782,"line":890},[1827],{"type":45,"tag":780,"props":1828,"children":1829},{},[1830],{"type":50,"value":1567},{"type":45,"tag":780,"props":1832,"children":1833},{"class":782,"line":898},[1834],{"type":45,"tag":780,"props":1835,"children":1836},{},[1837],{"type":50,"value":1838},"host all all all ldap \"ldapserver=ldap.example.com\" \"ldapport=636\" \"ldapbasedn=dc=example,dc=com\" \"ldapsearchattribute=uid\" \"ldapsearchfilter=(objectClass=inetOrgPerson)\" \"ldapbinddn=cn=readonly,dc=example,dc=com\" \"ldapbindpasswd=\u003Cbind-password>\"\n",{"type":45,"tag":780,"props":1840,"children":1841},{"class":782,"line":907},[1842],{"type":45,"tag":780,"props":1843,"children":1844},{},[1845],{"type":50,"value":1583},{"type":45,"tag":780,"props":1847,"children":1848},{"class":782,"line":916},[1849],{"type":45,"tag":780,"props":1850,"children":1851},{},[1852],{"type":50,"value":1289},{"type":45,"tag":333,"props":1854,"children":1856},{"id":1855},"_44-configure-ldap-group-to-role-mapping",[1857],{"type":50,"value":1858},"4.4 Configure LDAP Group-to-Role Mapping",{"type":45,"tag":53,"props":1860,"children":1861},{},[1862,1864,1870],{"type":50,"value":1863},"LDAP group mapping assigns CockroachDB SQL roles based on LDAP\u002FAD group membership. Group mapping is configured via the ",{"type":45,"tag":126,"props":1865,"children":1867},{"className":1866},[],[1868],{"type":50,"value":1869},"ldapgrouplistfilter",{"type":50,"value":1871}," HBA parameter — not via cluster settings.",{"type":45,"tag":769,"props":1873,"children":1875},{"className":771,"code":1874,"language":773,"meta":774,"style":774},"-- HBA with group-to-role mapping\nSET CLUSTER SETTING server.host_based_authentication.configuration = '\nhost all root all password\nhost all admin_user all password\nhost all all all ldap \"ldapserver=ad.corp.example.com\" \"ldapport=636\" \"ldapbasedn=ou=Users,dc=corp,dc=example,dc=com\" \"ldapsearchattribute=sAMAccountName\" \"ldapsearchfilter=(objectClass=user)\" \"ldapbinddn=cn=crdb-svc,ou=ServiceAccounts,dc=corp,dc=example,dc=com\" \"ldapbindpasswd=\u003Cservice-account-password>\" \"ldapgrouplistfilter=(&(objectClass=group)(member={{.User.DN}}))\"\nhost all all all password\n';\n",[1876],{"type":45,"tag":126,"props":1877,"children":1878},{"__ignoreMap":774},[1879,1887,1894,1901,1908,1916,1923],{"type":45,"tag":780,"props":1880,"children":1881},{"class":782,"line":783},[1882],{"type":45,"tag":780,"props":1883,"children":1884},{},[1885],{"type":50,"value":1886},"-- HBA with group-to-role mapping\n",{"type":45,"tag":780,"props":1888,"children":1889},{"class":782,"line":26},[1890],{"type":45,"tag":780,"props":1891,"children":1892},{},[1893],{"type":50,"value":1551},{"type":45,"tag":780,"props":1895,"children":1896},{"class":782,"line":22},[1897],{"type":45,"tag":780,"props":1898,"children":1899},{},[1900],{"type":50,"value":1559},{"type":45,"tag":780,"props":1902,"children":1903},{"class":782,"line":846},[1904],{"type":45,"tag":780,"props":1905,"children":1906},{},[1907],{"type":50,"value":1567},{"type":45,"tag":780,"props":1909,"children":1910},{"class":782,"line":855},[1911],{"type":45,"tag":780,"props":1912,"children":1913},{},[1914],{"type":50,"value":1915},"host all all all ldap \"ldapserver=ad.corp.example.com\" \"ldapport=636\" \"ldapbasedn=ou=Users,dc=corp,dc=example,dc=com\" \"ldapsearchattribute=sAMAccountName\" \"ldapsearchfilter=(objectClass=user)\" \"ldapbinddn=cn=crdb-svc,ou=ServiceAccounts,dc=corp,dc=example,dc=com\" \"ldapbindpasswd=\u003Cservice-account-password>\" \"ldapgrouplistfilter=(&(objectClass=group)(member={{.User.DN}}))\"\n",{"type":45,"tag":780,"props":1917,"children":1918},{"class":782,"line":864},[1919],{"type":45,"tag":780,"props":1920,"children":1921},{},[1922],{"type":50,"value":1583},{"type":45,"tag":780,"props":1924,"children":1925},{"class":782,"line":872},[1926],{"type":45,"tag":780,"props":1927,"children":1928},{},[1929],{"type":50,"value":1289},{"type":45,"tag":53,"props":1931,"children":1932},{},[1933],{"type":50,"value":1934},"The LDAP group CN is mapped directly to a SQL role name. The role must already exist in CockroachDB:",{"type":45,"tag":769,"props":1936,"children":1938},{"className":771,"code":1937,"language":773,"meta":774,"style":774},"CREATE ROLE IF NOT EXISTS db_admins;\nGRANT admin TO db_admins;\n",[1939],{"type":45,"tag":126,"props":1940,"children":1941},{"__ignoreMap":774},[1942,1950],{"type":45,"tag":780,"props":1943,"children":1944},{"class":782,"line":783},[1945],{"type":45,"tag":780,"props":1946,"children":1947},{},[1948],{"type":50,"value":1949},"CREATE ROLE IF NOT EXISTS db_admins;\n",{"type":45,"tag":780,"props":1951,"children":1952},{"class":782,"line":26},[1953],{"type":45,"tag":780,"props":1954,"children":1955},{},[1956],{"type":50,"value":1957},"GRANT admin TO db_admins;\n",{"type":45,"tag":333,"props":1959,"children":1961},{"id":1960},"_45-enable-auto-user-provisioning-optional",[1962],{"type":50,"value":1963},"4.5 Enable Auto User Provisioning (Optional)",{"type":45,"tag":53,"props":1965,"children":1966},{},[1967],{"type":50,"value":1968},"Auto-provision SQL users when they first authenticate via LDAP:",{"type":45,"tag":769,"props":1970,"children":1972},{"className":771,"code":1971,"language":773,"meta":774,"style":774},"SET CLUSTER SETTING security.provisioning.ldap.enabled = true;\n",[1973],{"type":45,"tag":126,"props":1974,"children":1975},{"__ignoreMap":774},[1976],{"type":45,"tag":780,"props":1977,"children":1978},{"class":782,"line":783},[1979],{"type":45,"tag":780,"props":1980,"children":1981},{},[1982],{"type":50,"value":1971},{"type":45,"tag":333,"props":1984,"children":1986},{"id":1985},"_46-test-ldap-authentication",[1987],{"type":50,"value":1988},"4.6 Test LDAP Authentication",{"type":45,"tag":769,"props":1990,"children":1992},{"className":1328,"code":1991,"language":1330,"meta":774,"style":774},"# Test with an LDAP user credential\ncockroach sql --url \"postgresql:\u002F\u002F\u003Cldap-username>:\u003Cldap-password>@\u003Ccluster-host>:26257\u002Fdefaultdb?sslmode=verify-full\"\n",[1993],{"type":45,"tag":126,"props":1994,"children":1995},{"__ignoreMap":774},[1996,2004],{"type":45,"tag":780,"props":1997,"children":1998},{"class":782,"line":783},[1999],{"type":45,"tag":780,"props":2000,"children":2001},{"style":1340},[2002],{"type":50,"value":2003},"# Test with an LDAP user credential\n",{"type":45,"tag":780,"props":2005,"children":2006},{"class":782,"line":26},[2007,2011,2015,2019,2023,2028],{"type":45,"tag":780,"props":2008,"children":2009},{"style":1357},[2010],{"type":50,"value":1360},{"type":45,"tag":780,"props":2012,"children":2013},{"style":1363},[2014],{"type":50,"value":1366},{"type":45,"tag":780,"props":2016,"children":2017},{"style":1363},[2018],{"type":50,"value":1371},{"type":45,"tag":780,"props":2020,"children":2021},{"style":1374},[2022],{"type":50,"value":1377},{"type":45,"tag":780,"props":2024,"children":2025},{"style":1363},[2026],{"type":50,"value":2027},"postgresql:\u002F\u002F\u003Cldap-username>:\u003Cldap-password>@\u003Ccluster-host>:26257\u002Fdefaultdb?sslmode=verify-full",{"type":45,"tag":780,"props":2029,"children":2030},{"style":1374},[2031],{"type":50,"value":2032},"\"\n",{"type":45,"tag":769,"props":2034,"children":2036},{"className":771,"code":2035,"language":773,"meta":774,"style":774},"-- Verify the user connected successfully\nSELECT current_user();\n\n-- If group mapping is enabled, verify role grants\nSHOW GRANTS FOR \u003Cldap-username>;\n",[2037],{"type":45,"tag":126,"props":2038,"children":2039},{"__ignoreMap":774},[2040,2048,2055,2062,2070],{"type":45,"tag":780,"props":2041,"children":2042},{"class":782,"line":783},[2043],{"type":45,"tag":780,"props":2044,"children":2045},{},[2046],{"type":50,"value":2047},"-- Verify the user connected successfully\n",{"type":45,"tag":780,"props":2049,"children":2050},{"class":782,"line":26},[2051],{"type":45,"tag":780,"props":2052,"children":2053},{},[2054],{"type":50,"value":1428},{"type":45,"tag":780,"props":2056,"children":2057},{"class":782,"line":22},[2058],{"type":45,"tag":780,"props":2059,"children":2060},{"emptyLinePlaceholder":840},[2061],{"type":50,"value":843},{"type":45,"tag":780,"props":2063,"children":2064},{"class":782,"line":846},[2065],{"type":45,"tag":780,"props":2066,"children":2067},{},[2068],{"type":50,"value":2069},"-- If group mapping is enabled, verify role grants\n",{"type":45,"tag":780,"props":2071,"children":2072},{"class":782,"line":855},[2073],{"type":45,"tag":780,"props":2074,"children":2075},{},[2076],{"type":50,"value":2077},"SHOW GRANTS FOR \u003Cldap-username>;\n",{"type":45,"tag":321,"props":2079,"children":2081},{"id":2080},"part-5-scim-20-on-cloud-console",[2082],{"type":50,"value":2083},"Part 5: SCIM 2.0 on Cloud Console",{"type":45,"tag":731,"props":2085,"children":2086},{},[2087],{"type":45,"tag":53,"props":2088,"children":2089},{},[2090,2095],{"type":45,"tag":67,"props":2091,"children":2092},{},[2093],{"type":50,"value":2094},"Skip this section",{"type":50,"value":2096}," if the user does not need automated user provisioning or does not have an Enterprise plan.",{"type":45,"tag":53,"props":2098,"children":2099},{},[2100],{"type":50,"value":2101},"SCIM 2.0 enables automated user provisioning and deprovisioning on the Cloud Console, syncing user lifecycle with your IdP.",{"type":45,"tag":333,"props":2103,"children":2105},{"id":2104},"_51-check-current-scim-configuration",[2106],{"type":50,"value":2107},"5.1 Check Current SCIM Configuration",{"type":45,"tag":53,"props":2109,"children":2110},{},[2111,2113,2118],{"type":50,"value":2112},"Check SCIM status in the Cloud Console UI (Organization Settings > Authentication > SCIM). The ",{"type":45,"tag":126,"props":2114,"children":2116},{"className":2115},[],[2117],{"type":50,"value":131},{"type":50,"value":2119}," CLI does not currently expose SCIM configuration commands.",{"type":45,"tag":333,"props":2121,"children":2123},{"id":2122},"_52-enable-scim-endpoint",[2124],{"type":50,"value":2125},"5.2 Enable SCIM Endpoint",{"type":45,"tag":59,"props":2127,"children":2128},{},[2129,2139,2144],{"type":45,"tag":63,"props":2130,"children":2131},{},[2132,2133,2138],{"type":50,"value":369},{"type":45,"tag":67,"props":2134,"children":2135},{},[2136],{"type":50,"value":2137},"Organization Settings > Authentication > SCIM",{"type":50,"value":376},{"type":45,"tag":63,"props":2140,"children":2141},{},[2142],{"type":50,"value":2143},"Enable the SCIM 2.0 endpoint",{"type":45,"tag":63,"props":2145,"children":2146},{},[2147,2149,2154,2155,2160],{"type":50,"value":2148},"Copy the ",{"type":45,"tag":67,"props":2150,"children":2151},{},[2152],{"type":50,"value":2153},"SCIM base URL",{"type":50,"value":412},{"type":45,"tag":67,"props":2156,"children":2157},{},[2158],{"type":50,"value":2159},"Bearer token",{"type":50,"value":2161}," for IdP configuration",{"type":45,"tag":333,"props":2163,"children":2165},{"id":2164},"_53-configure-idp-for-scim",[2166],{"type":50,"value":2167},"5.3 Configure IdP for SCIM",{"type":45,"tag":53,"props":2169,"children":2170},{},[2171],{"type":50,"value":2172},"In your IdP (Okta, Azure AD, etc.):",{"type":45,"tag":59,"props":2174,"children":2175},{},[2176,2181,2186,2191,2229],{"type":45,"tag":63,"props":2177,"children":2178},{},[2179],{"type":50,"value":2180},"Add a new SCIM provisioning integration",{"type":45,"tag":63,"props":2182,"children":2183},{},[2184],{"type":50,"value":2185},"Enter the SCIM base URL from step 5.2",{"type":45,"tag":63,"props":2187,"children":2188},{},[2189],{"type":50,"value":2190},"Enter the Bearer token for authentication",{"type":45,"tag":63,"props":2192,"children":2193},{},[2194,2196],{"type":50,"value":2195},"Configure provisioning actions:\n",{"type":45,"tag":112,"props":2197,"children":2198},{},[2199,2209,2219],{"type":45,"tag":63,"props":2200,"children":2201},{},[2202,2207],{"type":45,"tag":67,"props":2203,"children":2204},{},[2205],{"type":50,"value":2206},"Create users",{"type":50,"value":2208}," — New IdP users are created in CockroachDB Cloud",{"type":45,"tag":63,"props":2210,"children":2211},{},[2212,2217],{"type":45,"tag":67,"props":2213,"children":2214},{},[2215],{"type":50,"value":2216},"Update user attributes",{"type":50,"value":2218}," — Name and email changes sync",{"type":45,"tag":63,"props":2220,"children":2221},{},[2222,2227],{"type":45,"tag":67,"props":2223,"children":2224},{},[2225],{"type":50,"value":2226},"Deactivate users",{"type":50,"value":2228}," — Removed IdP users are deactivated in CockroachDB Cloud",{"type":45,"tag":63,"props":2230,"children":2231},{},[2232],{"type":50,"value":2233},"Assign users or groups to the SCIM integration",{"type":45,"tag":53,"props":2235,"children":2236},{},[2237,2238,2242],{"type":50,"value":503},{"type":45,"tag":505,"props":2239,"children":2240},{"href":507},[2241],{"type":50,"value":510},{"type":50,"value":2243}," for IdP-specific SCIM setup.",{"type":45,"tag":333,"props":2245,"children":2247},{"id":2246},"_54-verify-scim-provisioning",[2248],{"type":50,"value":2249},"5.4 Verify SCIM Provisioning",{"type":45,"tag":59,"props":2251,"children":2252},{},[2253,2258,2263,2268],{"type":45,"tag":63,"props":2254,"children":2255},{},[2256],{"type":50,"value":2257},"Create a test user in your IdP and assign them to the SCIM integration",{"type":45,"tag":63,"props":2259,"children":2260},{},[2261],{"type":50,"value":2262},"Check the Cloud Console — the user should appear within a few minutes",{"type":45,"tag":63,"props":2264,"children":2265},{},[2266],{"type":50,"value":2267},"Remove the test user from the IdP SCIM assignment",{"type":45,"tag":63,"props":2269,"children":2270},{},[2271],{"type":50,"value":2272},"Verify the user is deactivated in the Cloud Console",{"type":45,"tag":105,"props":2274,"children":2276},{"id":2275},"troubleshooting",[2277],{"type":50,"value":2278},"Troubleshooting",{"type":45,"tag":321,"props":2280,"children":2282},{"id":2281},"sso-lockout-recovery",[2283],{"type":50,"value":2284},"SSO Lockout Recovery",{"type":45,"tag":53,"props":2286,"children":2287},{},[2288],{"type":50,"value":2289},"If SSO is enforced and the IdP becomes unavailable or misconfigured:",{"type":45,"tag":59,"props":2291,"children":2292},{},[2293,2303,2313],{"type":45,"tag":63,"props":2294,"children":2295},{},[2296,2301],{"type":45,"tag":67,"props":2297,"children":2298},{},[2299],{"type":50,"value":2300},"Use the break-glass account:",{"type":50,"value":2302}," Log in with the pre-configured password-based admin account",{"type":45,"tag":63,"props":2304,"children":2305},{},[2306,2311],{"type":45,"tag":67,"props":2307,"children":2308},{},[2309],{"type":50,"value":2310},"Disable SSO enforcement:",{"type":50,"value":2312}," Navigate to Organization Settings > Authentication and disable \"Require SSO\"",{"type":45,"tag":63,"props":2314,"children":2315},{},[2316,2321],{"type":45,"tag":67,"props":2317,"children":2318},{},[2319],{"type":50,"value":2320},"If no break-glass account exists:",{"type":50,"value":2322}," Contact CockroachDB Cloud support to disable SSO enforcement for your organization",{"type":45,"tag":53,"props":2324,"children":2325},{},[2326,2331],{"type":45,"tag":67,"props":2327,"children":2328},{},[2329],{"type":50,"value":2330},"Prevention:",{"type":50,"value":2332}," Always create and test a break-glass admin account before enforcing SSO.",{"type":45,"tag":321,"props":2334,"children":2336},{"id":2335},"jwt-authentication-errors",[2337],{"type":50,"value":2338},"JWT Authentication Errors",{"type":45,"tag":53,"props":2340,"children":2341},{},[2342],{"type":45,"tag":67,"props":2343,"children":2344},{},[2345],{"type":50,"value":2346},"\"ERROR: JWT authentication: invalid token\"",{"type":45,"tag":112,"props":2348,"children":2349},{},[2350,2361,2366,2385,2396],{"type":45,"tag":63,"props":2351,"children":2352},{},[2353,2355],{"type":50,"value":2354},"Verify the JWT issuer configuration in ",{"type":45,"tag":126,"props":2356,"children":2358},{"className":2357},[],[2359],{"type":50,"value":2360},"server.jwt_authentication.issuers.configuration",{"type":45,"tag":63,"props":2362,"children":2363},{},[2364],{"type":50,"value":2365},"Check that the JWT token has not expired",{"type":45,"tag":63,"props":2367,"children":2368},{},[2369,2371,2377,2379],{"type":50,"value":2370},"Verify that ",{"type":45,"tag":126,"props":2372,"children":2374},{"className":2373},[],[2375],{"type":50,"value":2376},"server.jwt_authentication.jwks_auto_fetch.enabled",{"type":50,"value":2378}," is ",{"type":45,"tag":126,"props":2380,"children":2382},{"className":2381},[],[2383],{"type":50,"value":2384},"true",{"type":45,"tag":63,"props":2386,"children":2387},{},[2388,2390],{"type":50,"value":2389},"Inspect the token contents: ",{"type":45,"tag":126,"props":2391,"children":2393},{"className":2392},[],[2394],{"type":50,"value":2395},"echo '\u003Ctoken>' | cut -d. -f2 | base64 -d | jq .",{"type":45,"tag":63,"props":2397,"children":2398},{},[2399,2401,2407],{"type":50,"value":2400},"Verify the ",{"type":45,"tag":126,"props":2402,"children":2404},{"className":2403},[],[2405],{"type":50,"value":2406},"aud",{"type":50,"value":2408}," (audience) claim in the token matches the configured audience",{"type":45,"tag":53,"props":2410,"children":2411},{},[2412],{"type":45,"tag":67,"props":2413,"children":2414},{},[2415],{"type":50,"value":2416},"\"ERROR: JWT authentication: issuer not configured\"",{"type":45,"tag":112,"props":2418,"children":2419},{},[2420,2430],{"type":45,"tag":63,"props":2421,"children":2422},{},[2423,2425],{"type":50,"value":2424},"The issuer URL in the token does not match ",{"type":45,"tag":126,"props":2426,"children":2428},{"className":2427},[],[2429],{"type":50,"value":2360},{"type":45,"tag":63,"props":2431,"children":2432},{},[2433],{"type":50,"value":2434},"Re-check the issuer URL matches exactly (trailing slashes matter)",{"type":45,"tag":321,"props":2436,"children":2438},{"id":2437},"db-console-oidc-errors",[2439],{"type":50,"value":2440},"DB Console OIDC Errors",{"type":45,"tag":53,"props":2442,"children":2443},{},[2444],{"type":45,"tag":67,"props":2445,"children":2446},{},[2447],{"type":50,"value":2448},"\"OIDC: unable to match principal\"",{"type":45,"tag":112,"props":2450,"children":2451},{},[2452,2465],{"type":45,"tag":63,"props":2453,"children":2454},{},[2455,2457,2463],{"type":50,"value":2456},"The ",{"type":45,"tag":126,"props":2458,"children":2460},{"className":2459},[],[2461],{"type":50,"value":2462},"server.oidc_authentication.principal_regex",{"type":50,"value":2464}," does not match the claim value from the token",{"type":45,"tag":63,"props":2466,"children":2467},{},[2468],{"type":50,"value":2469},"Test the regex against the actual claim value:",{"type":45,"tag":769,"props":2471,"children":2473},{"className":771,"code":2472,"language":773,"meta":774,"style":774},"SHOW CLUSTER SETTING server.oidc_authentication.principal_regex;\n-- Common patterns:\n-- Email -> username (strip domain): '^([^@]+)'\n-- Full email as username: '^(.+)$'\n",[2474],{"type":45,"tag":126,"props":2475,"children":2476},{"__ignoreMap":774},[2477,2485,2493,2501],{"type":45,"tag":780,"props":2478,"children":2479},{"class":782,"line":783},[2480],{"type":45,"tag":780,"props":2481,"children":2482},{},[2483],{"type":50,"value":2484},"SHOW CLUSTER SETTING server.oidc_authentication.principal_regex;\n",{"type":45,"tag":780,"props":2486,"children":2487},{"class":782,"line":26},[2488],{"type":45,"tag":780,"props":2489,"children":2490},{},[2491],{"type":50,"value":2492},"-- Common patterns:\n",{"type":45,"tag":780,"props":2494,"children":2495},{"class":782,"line":22},[2496],{"type":45,"tag":780,"props":2497,"children":2498},{},[2499],{"type":50,"value":2500},"-- Email -> username (strip domain): '^([^@]+)'\n",{"type":45,"tag":780,"props":2502,"children":2503},{"class":782,"line":846},[2504],{"type":45,"tag":780,"props":2505,"children":2506},{},[2507],{"type":50,"value":2508},"-- Full email as username: '^(.+)$'\n",{"type":45,"tag":53,"props":2510,"children":2511},{},[2512],{"type":45,"tag":67,"props":2513,"children":2514},{},[2515],{"type":50,"value":2516},"Complex regex not accepted:",{"type":45,"tag":112,"props":2518,"children":2519},{},[2520,2533],{"type":45,"tag":63,"props":2521,"children":2522},{},[2523,2525,2531],{"type":50,"value":2524},"CockroachDB uses Go's ",{"type":45,"tag":126,"props":2526,"children":2528},{"className":2527},[],[2529],{"type":50,"value":2530},"regexp",{"type":50,"value":2532}," syntax (no lookaheads\u002Flookbehinds)",{"type":45,"tag":63,"props":2534,"children":2535},{},[2536,2538,2545],{"type":50,"value":2537},"Test at ",{"type":45,"tag":505,"props":2539,"children":2543},{"href":2540,"rel":2541},"https:\u002F\u002Fregex101.com\u002F",[2542],"nofollow",[2544],{"type":50,"value":2540},{"type":50,"value":2546}," with the \"Golang\" flavor",{"type":45,"tag":321,"props":2548,"children":2550},{"id":2549},"ldap-authentication-errors",[2551],{"type":50,"value":2552},"LDAP Authentication Errors",{"type":45,"tag":53,"props":2554,"children":2555},{},[2556],{"type":45,"tag":67,"props":2557,"children":2558},{},[2559],{"type":50,"value":2560},"\"ERROR: LDAP authentication: unable to bind\"",{"type":45,"tag":112,"props":2562,"children":2563},{},[2564,2582,2587],{"type":45,"tag":63,"props":2565,"children":2566},{},[2567,2569,2574,2575,2580],{"type":50,"value":2568},"Verify ",{"type":45,"tag":126,"props":2570,"children":2572},{"className":2571},[],[2573],{"type":50,"value":1692},{"type":50,"value":412},{"type":45,"tag":126,"props":2576,"children":2578},{"className":2577},[],[2579],{"type":50,"value":1703},{"type":50,"value":2581}," are correct",{"type":45,"tag":63,"props":2583,"children":2584},{},[2585],{"type":50,"value":2586},"Check that the bind service account has read access to the user search base",{"type":45,"tag":63,"props":2588,"children":2589},{},[2590,2592],{"type":50,"value":2591},"Test with: ",{"type":45,"tag":126,"props":2593,"children":2595},{"className":2594},[],[2596],{"type":50,"value":2597},"ldapsearch -H ldap:\u002F\u002Fldap.example.com -D \"cn=readonly,dc=example,dc=com\" -W -b \"dc=example,dc=com\" \"(uid=testuser)\"",{"type":45,"tag":53,"props":2599,"children":2600},{},[2601],{"type":45,"tag":67,"props":2602,"children":2603},{},[2604],{"type":50,"value":2605},"\"ERROR: LDAP authentication: user not found\"",{"type":45,"tag":112,"props":2607,"children":2608},{},[2609,2620,2644],{"type":45,"tag":63,"props":2610,"children":2611},{},[2612,2613,2618],{"type":50,"value":2568},{"type":45,"tag":126,"props":2614,"children":2616},{"className":2615},[],[2617],{"type":50,"value":1629},{"type":50,"value":2619}," includes the OU where the user resides",{"type":45,"tag":63,"props":2621,"children":2622},{},[2623,2625,2630,2632,2637,2638,2643],{"type":50,"value":2624},"Check that ",{"type":45,"tag":126,"props":2626,"children":2628},{"className":2627},[],[2629],{"type":50,"value":1640},{"type":50,"value":2631}," matches the login attribute (",{"type":45,"tag":126,"props":2633,"children":2635},{"className":2634},[],[2636],{"type":50,"value":1648},{"type":50,"value":1650},{"type":45,"tag":126,"props":2639,"children":2641},{"className":2640},[],[2642],{"type":50,"value":1656},{"type":50,"value":1658},{"type":45,"tag":63,"props":2645,"children":2646},{},[2647,2658],{"type":45,"tag":67,"props":2648,"children":2649},{},[2650,2651,2656],{"type":50,"value":2624},{"type":45,"tag":126,"props":2652,"children":2654},{"className":2653},[],[2655],{"type":50,"value":1667},{"type":50,"value":2657}," is set",{"type":50,"value":2659}," — without it, LDAP user search will fail",{"type":45,"tag":53,"props":2661,"children":2662},{},[2663],{"type":45,"tag":67,"props":2664,"children":2665},{},[2666],{"type":50,"value":2667},"LDAP lockout — all users blocked",{"type":45,"tag":112,"props":2669,"children":2670},{},[2671,2683,2716],{"type":45,"tag":63,"props":2672,"children":2673},{},[2674,2676,2681],{"type":50,"value":2675},"This happens when an overly broad HBA rule like ",{"type":45,"tag":126,"props":2677,"children":2679},{"className":2678},[],[2680],{"type":50,"value":1465},{"type":50,"value":2682}," is the first rule and the LDAP server is unreachable, or the LDAP config is wrong",{"type":45,"tag":63,"props":2684,"children":2685},{},[2686,2691,2693,2698,2700,2706,2708,2714],{"type":45,"tag":67,"props":2687,"children":2688},{},[2689],{"type":50,"value":2690},"Fix:",{"type":50,"value":2692}," Ensure ",{"type":45,"tag":126,"props":2694,"children":2696},{"className":2695},[],[2697],{"type":50,"value":42},{"type":50,"value":2699}," and admin users have explicit ",{"type":45,"tag":126,"props":2701,"children":2703},{"className":2702},[],[2704],{"type":50,"value":2705},"password",{"type":50,"value":2707}," rules BEFORE any ",{"type":45,"tag":126,"props":2709,"children":2711},{"className":2710},[],[2712],{"type":50,"value":2713},"ldap",{"type":50,"value":2715}," rule",{"type":45,"tag":63,"props":2717,"children":2718},{},[2719,2724,2726,2731],{"type":45,"tag":67,"props":2720,"children":2721},{},[2722],{"type":50,"value":2723},"Recovery:",{"type":50,"value":2725}," Connect as ",{"type":45,"tag":126,"props":2727,"children":2729},{"className":2728},[],[2730],{"type":50,"value":42},{"type":50,"value":2732}," using client certificate auth (bypasses HBA) and fix the HBA configuration",{"type":45,"tag":53,"props":2734,"children":2735},{},[2736],{"type":45,"tag":67,"props":2737,"children":2738},{},[2739],{"type":50,"value":2740},"LDAP server unreachable",{"type":45,"tag":112,"props":2742,"children":2743},{},[2744,2749,2760],{"type":45,"tag":63,"props":2745,"children":2746},{},[2747],{"type":50,"value":2748},"Verify network connectivity from CockroachDB nodes to the LDAP server",{"type":45,"tag":63,"props":2750,"children":2751},{},[2752,2754],{"type":50,"value":2753},"For LDAPS, ensure the CA certificate is configured via ",{"type":45,"tag":126,"props":2755,"children":2757},{"className":2756},[],[2758],{"type":50,"value":2759},"server.ldap_authentication.domain.custom_ca",{"type":45,"tag":63,"props":2761,"children":2762},{},[2763],{"type":50,"value":2764},"Check firewall rules for port 389 (LDAP) or 636 (LDAPS)",{"type":45,"tag":321,"props":2766,"children":2768},{"id":2767},"azure-ad-entra-id-specific-issues",[2769],{"type":50,"value":2770},"Azure AD \u002F Entra ID Specific Issues",{"type":45,"tag":53,"props":2772,"children":2773},{},[2774],{"type":45,"tag":67,"props":2775,"children":2776},{},[2777],{"type":50,"value":2778},"Token audience mismatch:",{"type":45,"tag":112,"props":2780,"children":2781},{},[2782,2794,2806],{"type":45,"tag":63,"props":2783,"children":2784},{},[2785,2787,2792],{"type":50,"value":2786},"Azure AD tokens include an ",{"type":45,"tag":126,"props":2788,"children":2790},{"className":2789},[],[2791],{"type":50,"value":2406},{"type":50,"value":2793}," claim that must match the configured audience",{"type":45,"tag":63,"props":2795,"children":2796},{},[2797,2799,2804],{"type":50,"value":2798},"For JWT SQL SSO: ensure the audience in ",{"type":45,"tag":126,"props":2800,"children":2802},{"className":2801},[],[2803],{"type":50,"value":2360},{"type":50,"value":2805}," matches",{"type":45,"tag":63,"props":2807,"children":2808},{},[2809,2811,2817],{"type":50,"value":2810},"For DB Console OIDC: ensure ",{"type":45,"tag":126,"props":2812,"children":2814},{"className":2813},[],[2815],{"type":50,"value":2816},"server.oidc_authentication.client_id",{"type":50,"value":2805},{"type":45,"tag":53,"props":2819,"children":2820},{},[2821],{"type":45,"tag":67,"props":2822,"children":2823},{},[2824],{"type":50,"value":2825},"Multi-tenant vs single-tenant:",{"type":45,"tag":112,"props":2827,"children":2828},{},[2829,2842],{"type":45,"tag":63,"props":2830,"children":2831},{},[2832,2834,2840],{"type":50,"value":2833},"For single-tenant: use ",{"type":45,"tag":126,"props":2835,"children":2837},{"className":2836},[],[2838],{"type":50,"value":2839},"https:\u002F\u002Flogin.microsoftonline.com\u002F\u003Ctenant-id>\u002Fv2.0",{"type":50,"value":2841}," as the issuer",{"type":45,"tag":63,"props":2843,"children":2844},{},[2845,2847,2853],{"type":50,"value":2846},"For multi-tenant: use ",{"type":45,"tag":126,"props":2848,"children":2850},{"className":2849},[],[2851],{"type":50,"value":2852},"https:\u002F\u002Flogin.microsoftonline.com\u002Fcommon\u002Fv2.0",{"type":50,"value":2854}," (requires additional validation)",{"type":45,"tag":321,"props":2856,"children":2858},{"id":2857},"missing-ldapsearchfilter",[2859],{"type":50,"value":2860},"Missing ldapsearchfilter",{"type":45,"tag":53,"props":2862,"children":2863},{},[2864,2866,2871],{"type":50,"value":2865},"If LDAP authentication fails with \"user not found\" errors but the user exists in the directory, check whether ",{"type":45,"tag":126,"props":2867,"children":2869},{"className":2868},[],[2870],{"type":50,"value":1667},{"type":50,"value":2872}," is included in the HBA rule. This parameter is required and without it the LDAP search may fail silently or return no results.",{"type":45,"tag":105,"props":2874,"children":2876},{"id":2875},"safety-considerations",[2877],{"type":50,"value":2878},"Safety Considerations",{"type":45,"tag":53,"props":2880,"children":2881},{},[2882,2887],{"type":45,"tag":67,"props":2883,"children":2884},{},[2885],{"type":50,"value":2886},"SSO misconfiguration can lock out users.",{"type":50,"value":2888}," If SSO is enforced and the IdP is down or misconfigured, no one can log in.",{"type":45,"tag":53,"props":2890,"children":2891},{},[2892],{"type":45,"tag":67,"props":2893,"children":2894},{},[2895],{"type":50,"value":2896},"Mitigation — Break-glass account:",{"type":45,"tag":59,"props":2898,"children":2899},{},[2900,2905,2910,2915],{"type":45,"tag":63,"props":2901,"children":2902},{},[2903],{"type":50,"value":2904},"Before enforcing SSO, ensure at least one organization admin account uses password authentication",{"type":45,"tag":63,"props":2906,"children":2907},{},[2908],{"type":50,"value":2909},"Document the break-glass account credentials in a secure vault (e.g., 1Password, HashiCorp Vault)",{"type":45,"tag":63,"props":2911,"children":2912},{},[2913],{"type":50,"value":2914},"Test the break-glass account periodically to ensure it still works",{"type":45,"tag":63,"props":2916,"children":2917},{},[2918],{"type":50,"value":2919},"For SQL SSO (JWT or LDAP), keep at least one SQL user with password authentication as a fallback",{"type":45,"tag":53,"props":2921,"children":2922},{},[2923,2928],{"type":45,"tag":67,"props":2924,"children":2925},{},[2926],{"type":50,"value":2927},"HBA first-match-wins — lockout risk:",{"type":50,"value":2929},"\nHBA rules are evaluated top-to-bottom. The first matching rule wins. This means:",{"type":45,"tag":112,"props":2931,"children":2932},{},[2933,2948,2953],{"type":45,"tag":63,"props":2934,"children":2935},{},[2936,2941,2943],{"type":45,"tag":126,"props":2937,"children":2939},{"className":2938},[],[2940],{"type":50,"value":1465},{"type":50,"value":2942}," as the first rule will force ALL users through LDAP — including ",{"type":45,"tag":126,"props":2944,"children":2946},{"className":2945},[],[2947],{"type":50,"value":42},{"type":45,"tag":63,"props":2949,"children":2950},{},[2951],{"type":50,"value":2952},"If the LDAP server goes down, ALL authentication fails (including admin access)",{"type":45,"tag":63,"props":2954,"children":2955},{},[2956],{"type":45,"tag":67,"props":2957,"children":2958},{},[2959,2961,2966],{"type":50,"value":2960},"Always place password rules for ",{"type":45,"tag":126,"props":2962,"children":2964},{"className":2963},[],[2965],{"type":50,"value":42},{"type":50,"value":2967}," and admin users BEFORE LDAP rules",{"type":45,"tag":53,"props":2969,"children":2970},{},[2971],{"type":50,"value":2972},"Example of a dangerous configuration:",{"type":45,"tag":769,"props":2974,"children":2978},{"className":2975,"code":2977,"language":50},[2976],"language-text","# DANGEROUS — locks out root if LDAP is unavailable\nhost all all all ldap ...\nhost all all all password\n",[2979],{"type":45,"tag":126,"props":2980,"children":2981},{"__ignoreMap":774},[2982],{"type":50,"value":2977},{"type":45,"tag":53,"props":2984,"children":2985},{},[2986],{"type":50,"value":2987},"Safe configuration:",{"type":45,"tag":769,"props":2989,"children":2992},{"className":2990,"code":2991,"language":50},[2976],"# SAFE — root and admins always have password fallback\nhost all root all password\nhost all admin_user all password\nhost all all all ldap ...\nhost all all all password\n",[2993],{"type":45,"tag":126,"props":2994,"children":2995},{"__ignoreMap":774},[2996],{"type":50,"value":2991},{"type":45,"tag":53,"props":2998,"children":2999},{},[3000],{"type":45,"tag":67,"props":3001,"children":3002},{},[3003],{"type":50,"value":3004},"SCIM risks:",{"type":45,"tag":112,"props":3006,"children":3007},{},[3008,3018],{"type":45,"tag":63,"props":3009,"children":3010},{},[3011,3016],{"type":45,"tag":67,"props":3012,"children":3013},{},[3014],{"type":50,"value":3015},"Mass deprovisioning:",{"type":50,"value":3017}," If the IdP SCIM assignment is accidentally removed, all provisioned users may be deactivated. Start with a small group before enabling for the full organization.",{"type":45,"tag":63,"props":3019,"children":3020},{},[3021,3026],{"type":45,"tag":67,"props":3022,"children":3023},{},[3024],{"type":50,"value":3025},"Attribute mapping errors:",{"type":50,"value":3027}," Incorrect attribute mapping can create users with wrong names or emails. Test with a single user first.",{"type":45,"tag":53,"props":3029,"children":3030},{},[3031],{"type":45,"tag":67,"props":3032,"children":3033},{},[3034],{"type":50,"value":3035},"LDAP\u002FAD risks:",{"type":45,"tag":112,"props":3037,"children":3038},{},[3039,3049,3066],{"type":45,"tag":63,"props":3040,"children":3041},{},[3042,3047],{"type":45,"tag":67,"props":3043,"children":3044},{},[3045],{"type":50,"value":3046},"LDAP server unavailability blocks authentication:",{"type":50,"value":3048}," If the LDAP server is down, users authenticating via LDAP cannot connect. Always keep password-based fallback HBA rules for admin users.",{"type":45,"tag":63,"props":3050,"children":3051},{},[3052,3057,3059,3064],{"type":45,"tag":67,"props":3053,"children":3054},{},[3055],{"type":50,"value":3056},"Use a restricted service account for LDAP bind:",{"type":50,"value":3058}," The ",{"type":45,"tag":126,"props":3060,"children":3062},{"className":3061},[],[3063],{"type":50,"value":1692},{"type":50,"value":3065}," account should have minimal read-only permissions. Never use a domain admin account.",{"type":45,"tag":63,"props":3067,"children":3068},{},[3069,3074,3076,3081],{"type":45,"tag":67,"props":3070,"children":3071},{},[3072],{"type":50,"value":3073},"Credential exposure without LDAPS:",{"type":50,"value":3075}," LDAP without TLS transmits passwords in cleartext. Always use LDAPS (port 636) with ",{"type":45,"tag":126,"props":3077,"children":3079},{"className":3078},[],[3080],{"type":50,"value":2759},{"type":50,"value":3082}," in production.",{"type":45,"tag":105,"props":3084,"children":3086},{"id":3085},"rollback",[3087],{"type":50,"value":3088},"Rollback",{"type":45,"tag":321,"props":3090,"children":3092},{"id":3091},"disable-cloud-console-sso-enforcement",[3093],{"type":50,"value":3094},"Disable Cloud Console SSO Enforcement",{"type":45,"tag":59,"props":3096,"children":3097},{},[3098,3103,3111],{"type":45,"tag":63,"props":3099,"children":3100},{},[3101],{"type":50,"value":3102},"Log in with the break-glass admin account",{"type":45,"tag":63,"props":3104,"children":3105},{},[3106,3107],{"type":50,"value":369},{"type":45,"tag":67,"props":3108,"children":3109},{},[3110],{"type":50,"value":374},{"type":45,"tag":63,"props":3112,"children":3113},{},[3114,3116,3120],{"type":50,"value":3115},"Disable ",{"type":45,"tag":67,"props":3117,"children":3118},{},[3119],{"type":50,"value":716},{"type":50,"value":3121}," to re-enable password login",{"type":45,"tag":321,"props":3123,"children":3125},{"id":3124},"disable-db-console-sso-oidc",[3126],{"type":50,"value":3127},"Disable DB Console SSO (OIDC)",{"type":45,"tag":769,"props":3129,"children":3131},{"className":771,"code":3130,"language":773,"meta":774,"style":774},"SET CLUSTER SETTING server.oidc_authentication.enabled = false;\n",[3132],{"type":45,"tag":126,"props":3133,"children":3134},{"__ignoreMap":774},[3135],{"type":45,"tag":780,"props":3136,"children":3137},{"class":782,"line":783},[3138],{"type":45,"tag":780,"props":3139,"children":3140},{},[3141],{"type":50,"value":3130},{"type":45,"tag":321,"props":3143,"children":3145},{"id":3144},"disable-sqlcluster-sso-jwt",[3146],{"type":50,"value":3147},"Disable SQL\u002FCluster SSO (JWT)",{"type":45,"tag":769,"props":3149,"children":3151},{"className":771,"code":3150,"language":773,"meta":774,"style":774},"SET CLUSTER SETTING server.jwt_authentication.enabled = false;\n",[3152],{"type":45,"tag":126,"props":3153,"children":3154},{"__ignoreMap":774},[3155],{"type":45,"tag":780,"props":3156,"children":3157},{"class":782,"line":783},[3158],{"type":45,"tag":780,"props":3159,"children":3160},{},[3161],{"type":50,"value":3150},{"type":45,"tag":321,"props":3163,"children":3165},{"id":3164},"disable-ldapad-authentication",[3166],{"type":50,"value":3167},"Disable LDAP\u002FAD Authentication",{"type":45,"tag":769,"props":3169,"children":3171},{"className":771,"code":3170,"language":773,"meta":774,"style":774},"-- Revert HBA to password-only authentication\nSET CLUSTER SETTING server.host_based_authentication.configuration = '\nhost all all all password\n';\n",[3172],{"type":45,"tag":126,"props":3173,"children":3174},{"__ignoreMap":774},[3175,3183,3190,3197],{"type":45,"tag":780,"props":3176,"children":3177},{"class":782,"line":783},[3178],{"type":45,"tag":780,"props":3179,"children":3180},{},[3181],{"type":50,"value":3182},"-- Revert HBA to password-only authentication\n",{"type":45,"tag":780,"props":3184,"children":3185},{"class":782,"line":26},[3186],{"type":45,"tag":780,"props":3187,"children":3188},{},[3189],{"type":50,"value":1551},{"type":45,"tag":780,"props":3191,"children":3192},{"class":782,"line":22},[3193],{"type":45,"tag":780,"props":3194,"children":3195},{},[3196],{"type":50,"value":1583},{"type":45,"tag":780,"props":3198,"children":3199},{"class":782,"line":846},[3200],{"type":45,"tag":780,"props":3201,"children":3202},{},[3203],{"type":50,"value":1289},{"type":45,"tag":321,"props":3205,"children":3207},{"id":3206},"disable-auto-user-provisioning",[3208],{"type":50,"value":3209},"Disable Auto User Provisioning",{"type":45,"tag":769,"props":3211,"children":3213},{"className":771,"code":3212,"language":773,"meta":774,"style":774},"-- Disable JWT auto-provisioning\nSET CLUSTER SETTING security.provisioning.jwt.enabled = false;\n\n-- Disable LDAP auto-provisioning\nSET CLUSTER SETTING security.provisioning.ldap.enabled = false;\n",[3214],{"type":45,"tag":126,"props":3215,"children":3216},{"__ignoreMap":774},[3217,3225,3233,3240,3248],{"type":45,"tag":780,"props":3218,"children":3219},{"class":782,"line":783},[3220],{"type":45,"tag":780,"props":3221,"children":3222},{},[3223],{"type":50,"value":3224},"-- Disable JWT auto-provisioning\n",{"type":45,"tag":780,"props":3226,"children":3227},{"class":782,"line":26},[3228],{"type":45,"tag":780,"props":3229,"children":3230},{},[3231],{"type":50,"value":3232},"SET CLUSTER SETTING security.provisioning.jwt.enabled = false;\n",{"type":45,"tag":780,"props":3234,"children":3235},{"class":782,"line":22},[3236],{"type":45,"tag":780,"props":3237,"children":3238},{"emptyLinePlaceholder":840},[3239],{"type":50,"value":843},{"type":45,"tag":780,"props":3241,"children":3242},{"class":782,"line":846},[3243],{"type":45,"tag":780,"props":3244,"children":3245},{},[3246],{"type":50,"value":3247},"-- Disable LDAP auto-provisioning\n",{"type":45,"tag":780,"props":3249,"children":3250},{"class":782,"line":855},[3251],{"type":45,"tag":780,"props":3252,"children":3253},{},[3254],{"type":50,"value":3255},"SET CLUSTER SETTING security.provisioning.ldap.enabled = false;\n",{"type":45,"tag":321,"props":3257,"children":3259},{"id":3258},"disable-scim",[3260],{"type":50,"value":3261},"Disable SCIM",{"type":45,"tag":59,"props":3263,"children":3264},{},[3265,3273,3278],{"type":45,"tag":63,"props":3266,"children":3267},{},[3268,3269],{"type":50,"value":369},{"type":45,"tag":67,"props":3270,"children":3271},{},[3272],{"type":50,"value":2137},{"type":45,"tag":63,"props":3274,"children":3275},{},[3276],{"type":50,"value":3277},"Disable the SCIM endpoint",{"type":45,"tag":63,"props":3279,"children":3280},{},[3281],{"type":50,"value":3282},"Remove the SCIM integration from your IdP",{"type":45,"tag":321,"props":3284,"children":3286},{"id":3285},"remove-identity-mapping",[3287],{"type":50,"value":3288},"Remove Identity Mapping",{"type":45,"tag":769,"props":3290,"children":3292},{"className":771,"code":3291,"language":773,"meta":774,"style":774},"SET CLUSTER SETTING server.identity_map.configuration = '';\n",[3293],{"type":45,"tag":126,"props":3294,"children":3295},{"__ignoreMap":774},[3296],{"type":45,"tag":780,"props":3297,"children":3298},{"class":782,"line":783},[3299],{"type":45,"tag":780,"props":3300,"children":3301},{},[3302],{"type":50,"value":3291},{"type":45,"tag":105,"props":3304,"children":3306},{"id":3305},"references",[3307],{"type":50,"value":3308},"References",{"type":45,"tag":53,"props":3310,"children":3311},{},[3312],{"type":45,"tag":67,"props":3313,"children":3314},{},[3315],{"type":50,"value":3316},"Skill references:",{"type":45,"tag":112,"props":3318,"children":3319},{},[3320],{"type":45,"tag":63,"props":3321,"children":3322},{},[3323],{"type":45,"tag":505,"props":3324,"children":3325},{"href":507},[3326],{"type":50,"value":3327},"IdP configuration steps",{"type":45,"tag":53,"props":3329,"children":3330},{},[3331],{"type":45,"tag":67,"props":3332,"children":3333},{},[3334],{"type":50,"value":3335},"Related skills:",{"type":45,"tag":112,"props":3337,"children":3338},{},[3339,3350,3361],{"type":45,"tag":63,"props":3340,"children":3341},{},[3342,3348],{"type":45,"tag":505,"props":3343,"children":3345},{"href":3344},"..\u002Fauditing-cloud-cluster-security\u002FSKILL.md",[3346],{"type":50,"value":3347},"auditing-cloud-cluster-security",{"type":50,"value":3349}," — Run a full security posture audit",{"type":45,"tag":63,"props":3351,"children":3352},{},[3353,3359],{"type":45,"tag":505,"props":3354,"children":3356},{"href":3355},"..\u002Fenforcing-password-policies\u002FSKILL.md",[3357],{"type":50,"value":3358},"enforcing-password-policies",{"type":50,"value":3360}," — Strengthen password policies as an alternative to SSO",{"type":45,"tag":63,"props":3362,"children":3363},{},[3364,3370],{"type":45,"tag":505,"props":3365,"children":3367},{"href":3366},"..\u002Fmanaging-tls-certificates\u002FSKILL.md",[3368],{"type":50,"value":3369},"managing-tls-certificates",{"type":50,"value":3371}," — Certificate-based authentication as an alternative to SSO",{"type":45,"tag":53,"props":3373,"children":3374},{},[3375],{"type":45,"tag":67,"props":3376,"children":3377},{},[3378],{"type":50,"value":3379},"Official CockroachDB Documentation:",{"type":45,"tag":112,"props":3381,"children":3382},{},[3383,3392,3401,3411,3421,3431,3441,3450,3460],{"type":45,"tag":63,"props":3384,"children":3385},{},[3386],{"type":45,"tag":505,"props":3387,"children":3390},{"href":3388,"rel":3389},"https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fcockroachcloud\u002Fcloud-org-sso.html",[2542],[3391],{"type":50,"value":71},{"type":45,"tag":63,"props":3393,"children":3394},{},[3395],{"type":45,"tag":505,"props":3396,"children":3399},{"href":3397,"rel":3398},"https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fstable\u002Fsso-db-console.html",[2542],[3400],{"type":50,"value":81},{"type":45,"tag":63,"props":3402,"children":3403},{},[3404],{"type":45,"tag":505,"props":3405,"children":3408},{"href":3406,"rel":3407},"https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fstable\u002Fsso-sql.html",[2542],[3409],{"type":50,"value":3410},"Cluster SSO (JWT)",{"type":45,"tag":63,"props":3412,"children":3413},{},[3414],{"type":45,"tag":505,"props":3415,"children":3418},{"href":3416,"rel":3417},"https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fcockroachcloud\u002Fconfigure-scim-provisioning",[2542],[3419],{"type":50,"value":3420},"SCIM Provisioning",{"type":45,"tag":63,"props":3422,"children":3423},{},[3424],{"type":45,"tag":505,"props":3425,"children":3428},{"href":3426,"rel":3427},"https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fstable\u002Fcluster-settings.html",[2542],[3429],{"type":50,"value":3430},"Cluster Settings",{"type":45,"tag":63,"props":3432,"children":3433},{},[3434],{"type":45,"tag":505,"props":3435,"children":3438},{"href":3436,"rel":3437},"https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fstable\u002Fsecurity-reference\u002Fauthentication.html",[2542],[3439],{"type":50,"value":3440},"HBA Configuration",{"type":45,"tag":63,"props":3442,"children":3443},{},[3444],{"type":45,"tag":505,"props":3445,"children":3447},{"href":3406,"rel":3446},[2542],[3448],{"type":50,"value":3449},"JWT Authentication",{"type":45,"tag":63,"props":3451,"children":3452},{},[3453],{"type":45,"tag":505,"props":3454,"children":3457},{"href":3455,"rel":3456},"https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fstable\u002Fldap-authentication",[2542],[3458],{"type":50,"value":3459},"LDAP Authentication",{"type":45,"tag":63,"props":3461,"children":3462},{},[3463],{"type":45,"tag":505,"props":3464,"children":3467},{"href":3465,"rel":3466},"https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fstable\u002Fsecurity-reference\u002Fauthentication",[2542],[3468],{"type":50,"value":3469},"Authentication Reference",{"type":45,"tag":3471,"props":3472,"children":3473},"style",{},[3474],{"type":50,"value":3475},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":3477,"total":3639},[3478,3499,3513,3528,3539,3549,3562,3574,3588,3603,3613,3626],{"slug":3479,"name":3479,"fn":3480,"description":3481,"org":3482,"tags":3483,"stars":3496,"repoUrl":3497,"updatedAt":3498},"collecting-cockroachdb-operator-escalation-packet","collect CockroachDB operator escalation packets","Collects a complete CockroachDB Operator escalation packet for TSC\u002FTSE or operator-team handoff, including Helm state, Kubernetes resources, logs, operation-specific evidence, pprof goroutine dumps, metrics, and a customer action timeline. Use when general diagnosis cannot resolve an operator-managed CockroachDB Helm issue or before restarting a stuck operator.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3484,3487,3490,3493],{"name":3485,"slug":3486,"type":15},"Database","database",{"name":3488,"slug":3489,"type":15},"Incident Response","incident-response",{"name":3491,"slug":3492,"type":15},"Kubernetes","kubernetes",{"name":3494,"slug":3495,"type":15},"Monitoring","monitoring",105,"https:\u002F\u002Fgithub.com\u002Fcockroachdb\u002Fhelm-charts","2026-07-12T07:57:25.288146",{"slug":3500,"name":3500,"fn":3501,"description":3502,"org":3503,"tags":3504,"stars":3496,"repoUrl":3497,"updatedAt":3512},"configuring-cockroachdb-helm-tls","configure TLS for CockroachDB Helm charts","Selects and validates TLS settings for CockroachDB Helm chart deployments, including self-signer, cert-manager, and external certificate modes. Use when a customer needs secure CockroachDB Helm values, certificate secret mapping, cert-manager integration, or TLS install troubleshooting before deploying the chart.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3505,3508,3511],{"name":3506,"slug":3507,"type":15},"Deployment","deployment",{"name":3509,"slug":3510,"type":15},"Encryption","encryption",{"name":13,"slug":14,"type":15},"2026-07-12T07:56:37.675396",{"slug":3514,"name":3514,"fn":3515,"description":3516,"org":3517,"tags":3518,"stars":3496,"repoUrl":3497,"updatedAt":3527},"debugging-cockroachdb-operator-migrations","debug CockroachDB Operator migration scenarios","Debugs CockroachDB Operator migration scenarios, including Helm StatefulSet to v1beta1 CrdbNode migration and public operator v1alpha1 to v1beta1 migration. Use when migration labels, migration phases, source StatefulSet ownership, converted CRDs, PVC ownership, or post-migration reconciliation are unclear or stuck.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3519,3520,3523,3524],{"name":3485,"slug":3486,"type":15},{"name":3521,"slug":3522,"type":15},"Debugging","debugging",{"name":3491,"slug":3492,"type":15},{"name":3525,"slug":3526,"type":15},"Migration","migration","2026-07-12T07:56:48.360871",{"slug":3529,"name":3529,"fn":3530,"description":3531,"org":3532,"tags":3533,"stars":3496,"repoUrl":3497,"updatedAt":3538},"diagnosing-cockroachdb-helm-deployments","diagnose CockroachDB Helm chart deployments","Diagnoses failed or unhealthy CockroachDB Helm chart deployments by checking Helm release state, operator health, CrdbCluster and CrdbNode status, pod readiness, RBAC, webhooks, TLS, upgrades, scaling, PVCs, DNS, and multi-region assumptions. Use when Helm install or upgrade fails, pods are not Ready, or the operator is not reconciling.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3534,3535,3536,3537],{"name":3485,"slug":3486,"type":15},{"name":3521,"slug":3522,"type":15},{"name":3506,"slug":3507,"type":15},{"name":3491,"slug":3492,"type":15},"2026-07-12T07:57:24.018818",{"slug":3540,"name":3540,"fn":3541,"description":3542,"org":3543,"tags":3544,"stars":3496,"repoUrl":3497,"updatedAt":3548},"installing-cockroachdb-with-helm","install CockroachDB using Helm","Guides customer-facing installation of CockroachDB on Kubernetes using the CockroachDB split Helm charts and operator-managed v1beta1 resources. Use when installing CockroachDB with Helm, choosing between published and local split charts, verifying a new install, or helping an agent complete first-time Kubernetes onboarding.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3545,3546,3547],{"name":3485,"slug":3486,"type":15},{"name":3506,"slug":3507,"type":15},{"name":3491,"slug":3492,"type":15},"2026-07-12T07:56:45.777567",{"slug":3550,"name":3550,"fn":3551,"description":3552,"org":3553,"tags":3554,"stars":3496,"repoUrl":3497,"updatedAt":3561},"validating-cockroachdb-helm-multiregion","validate CockroachDB multi-region Helm deployments","Validates CockroachDB Helm chart values and Kubernetes prerequisites for operator-managed multi-region deployments. Use before adding a region, deploying CockroachDB across multiple Kubernetes clusters, checking region DNS domains, or confirming that all regions share certificate and networking assumptions.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3555,3556,3557,3558],{"name":3485,"slug":3486,"type":15},{"name":3506,"slug":3507,"type":15},{"name":3491,"slug":3492,"type":15},{"name":3559,"slug":3560,"type":15},"Operations","operations","2026-07-12T07:56:47.082609",{"slug":3563,"name":3563,"fn":3564,"description":3565,"org":3566,"tags":3567,"stars":22,"repoUrl":23,"updatedAt":3573},"analyzing-range-distribution","analyze CockroachDB range distribution and health","Analyzes CockroachDB range distribution across tables and indexes using SHOW RANGES to identify range count, size patterns, leaseholder placement, and replication health. Use when investigating hotspots, uneven data distribution, range fragmentation, or validating zone configuration effects without DB Console access.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3568,3569,3570],{"name":3485,"slug":3486,"type":15},{"name":3494,"slug":3495,"type":15},{"name":3571,"slug":3572,"type":15},"Performance","performance","2026-07-12T07:57:18.753533",{"slug":3575,"name":3575,"fn":3576,"description":3577,"org":3578,"tags":3579,"stars":22,"repoUrl":23,"updatedAt":3587},"analyzing-schema-change-storage-risk","analyze schema change storage requirements","Estimates storage requirements for CockroachDB online schema change backfills using SHOW RANGES WITH DETAILS, KEYS, INDEXES. Use before CREATE INDEX, ADD COLUMN with INDEX\u002FUNIQUE, ALTER PRIMARY KEY, CREATE MATERIALIZED VIEW, CREATE TABLE AS, REFRESH, or SET LOCALITY on tables with large per-index footprints, to avoid mid-backfill disk exhaustion.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3580,3583,3584,3585],{"name":3581,"slug":3582,"type":15},"Data Modeling","data-modeling",{"name":3485,"slug":3486,"type":15},{"name":3571,"slug":3572,"type":15},{"name":3586,"slug":773,"type":15},"SQL","2026-07-12T07:57:22.763788",{"slug":3589,"name":3589,"fn":3590,"description":3591,"org":3592,"tags":3593,"stars":22,"repoUrl":23,"updatedAt":3602},"auditing-cis-benchmark","audit CockroachDB clusters against CIS benchmarks","Audits a self-hosted CockroachDB cluster against the CIS CockroachDB Benchmark v1.0.0 Level 1 controls. Supports two audit depths — quick automated scans and full CIS audit procedures. Produces a structured PASS\u002FFAIL\u002FMANUAL report covering installation, system hardening, logging, user access, data protection, and CockroachDB settings. Use when preparing for CIS compliance assessments, hardening self-hosted deployments, or validating security posture against industry benchmarks.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3594,3597,3600,3601],{"name":3595,"slug":3596,"type":15},"Audit","audit",{"name":3598,"slug":3599,"type":15},"Compliance","compliance",{"name":3485,"slug":3486,"type":15},{"name":13,"slug":14,"type":15},"2026-07-18T05:48:00.862384",{"slug":3347,"name":3347,"fn":3604,"description":3605,"org":3606,"tags":3607,"stars":22,"repoUrl":23,"updatedAt":3612},"audit CockroachDB cluster security posture","Audits the security posture of a CockroachDB cluster (Cloud or self-hosted) across network, authentication, authorization, encryption, audit logging, and backup dimensions. Use when assessing cluster security readiness, preparing for compliance reviews, or investigating security configuration gaps.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3608,3609,3610,3611],{"name":3595,"slug":3596,"type":15},{"name":3485,"slug":3486,"type":15},{"name":3559,"slug":3560,"type":15},{"name":13,"slug":14,"type":15},"2026-07-12T07:57:01.506735",{"slug":3614,"name":3614,"fn":3615,"description":3616,"org":3617,"tags":3618,"stars":22,"repoUrl":23,"updatedAt":3625},"auditing-table-statistics","audit optimizer table statistics","Audits optimizer table statistics for staleness, missing coverage, and data quality issues using SHOW STATISTICS. Use when diagnosing poor query performance, unexpected plan changes, or after bulk data changes to identify stale statistics requiring refresh via CREATE STATISTICS.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3619,3620,3623,3624],{"name":3595,"slug":3596,"type":15},{"name":3621,"slug":3622,"type":15},"Data Analysis","data-analysis",{"name":3485,"slug":3486,"type":15},{"name":3571,"slug":3572,"type":15},"2026-07-12T07:57:16.190081",{"slug":3627,"name":3627,"fn":3628,"description":3629,"org":3630,"tags":3631,"stars":22,"repoUrl":23,"updatedAt":3638},"benchmarking-transaction-patterns","benchmark CockroachDB transaction patterns","Guides benchmarking and comparing explicit multi-statement transactions versus single-statement CTE transactions in CockroachDB, with fair test methodology, contention analysis, and performance interpretation. Use when comparing transaction formulations, benchmarking CockroachDB workloads under contention, investigating retry pressure, or deciding whether to rewrite multi-step application flows into single SQL statements.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3632,3633,3636,3637],{"name":3485,"slug":3486,"type":15},{"name":3634,"slug":3635,"type":15},"Engineering","engineering",{"name":3571,"slug":3572,"type":15},{"name":3586,"slug":773,"type":15},"2026-07-12T07:57:26.543278",40,{"items":3641,"total":3693},[3642,3648,3655,3662,3669,3676,3683],{"slug":3563,"name":3563,"fn":3564,"description":3565,"org":3643,"tags":3644,"stars":22,"repoUrl":23,"updatedAt":3573},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3645,3646,3647],{"name":3485,"slug":3486,"type":15},{"name":3494,"slug":3495,"type":15},{"name":3571,"slug":3572,"type":15},{"slug":3575,"name":3575,"fn":3576,"description":3577,"org":3649,"tags":3650,"stars":22,"repoUrl":23,"updatedAt":3587},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3651,3652,3653,3654],{"name":3581,"slug":3582,"type":15},{"name":3485,"slug":3486,"type":15},{"name":3571,"slug":3572,"type":15},{"name":3586,"slug":773,"type":15},{"slug":3589,"name":3589,"fn":3590,"description":3591,"org":3656,"tags":3657,"stars":22,"repoUrl":23,"updatedAt":3602},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3658,3659,3660,3661],{"name":3595,"slug":3596,"type":15},{"name":3598,"slug":3599,"type":15},{"name":3485,"slug":3486,"type":15},{"name":13,"slug":14,"type":15},{"slug":3347,"name":3347,"fn":3604,"description":3605,"org":3663,"tags":3664,"stars":22,"repoUrl":23,"updatedAt":3612},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3665,3666,3667,3668],{"name":3595,"slug":3596,"type":15},{"name":3485,"slug":3486,"type":15},{"name":3559,"slug":3560,"type":15},{"name":13,"slug":14,"type":15},{"slug":3614,"name":3614,"fn":3615,"description":3616,"org":3670,"tags":3671,"stars":22,"repoUrl":23,"updatedAt":3625},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3672,3673,3674,3675],{"name":3595,"slug":3596,"type":15},{"name":3621,"slug":3622,"type":15},{"name":3485,"slug":3486,"type":15},{"name":3571,"slug":3572,"type":15},{"slug":3627,"name":3627,"fn":3628,"description":3629,"org":3677,"tags":3678,"stars":22,"repoUrl":23,"updatedAt":3638},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3679,3680,3681,3682],{"name":3485,"slug":3486,"type":15},{"name":3634,"slug":3635,"type":15},{"name":3571,"slug":3572,"type":15},{"name":3586,"slug":773,"type":15},{"slug":3684,"name":3684,"fn":3685,"description":3686,"org":3687,"tags":3688,"stars":22,"repoUrl":23,"updatedAt":3692},"cockroachdb-sql","write and optimize CockroachDB SQL","Use when writing, generating, or optimizing SQL for CockroachDB, designing CockroachDB schemas, or when the user asks about CockroachDB-specific SQL patterns, type mappings, and distributed database best practices. Also use when encountering CockroachDB anti-patterns like missing primary keys, sequential ID hotspots, or incorrect type usage.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3689,3690,3691],{"name":3485,"slug":3486,"type":15},{"name":3571,"slug":3572,"type":15},{"name":3586,"slug":773,"type":15},"2026-07-25T05:31:22.562808",34]