SQL User Lifecycle Management Automation | CockroachDB

CockroachDB introduces SQL-native lifecycle management for enterprise users authenticated through external identity providers such as Active Directory, Okta, LDAP, JWT, and OIDC, addressing the scalability limits of manually creating database accounts across large cluster fleets. Using PostgreSQL wire-protocol compatibility, existing drivers can pass external credentials without custom plugins, while HBA rules determine authentication methods and identity mapping. When enabled, just-in-time provisioning automatically creates a SQL user after successful first login and assigns an immutable PROVISIONSRC tag that records the identity source for auditing and targeted cleanup. On each subsequent login, CockroachDB can synchronize IdP group memberships to existing database roles, granting and revoking memberships so the identity provider remains the source of truth, although changes take effect at the next authentication. Estimated login timestamps, filtered SHOW USERS or SHOW ROLES queries, and the DROP PROVISIONED ROLES command support reviews and batch removal of inactive externally provisioned accounts, with safeguards for dependencies, system roles, privileges, metadata cleanup, and audit events. These features are intended to reduce administrative overhead, limit access drift, and provide evidence supporting workflows related to frameworks including CIS, SOC 2, PCI DSS, SOX, and GDPR, without asserting compliance on their own.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.