Skip to content

v0.1.0

Latest
Latest

Choose a tag to compare

View all tags
@BorisTyshkevich BorisTyshkevich released this 30 Sep 19:10
· 1 commit to main since this release
v0.1.0
f9bbd54
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Initial release of Altinity OAuth Helper for ClickHouse.

Highlights

  • ch-jwt-verify: validates OAuth JWTs presented as HTTP Basic passwords through ClickHouse HTTP authentication.
  • ch-oauth-ldap: standalone LDAPv3 authentication with JWT simple-Bind passwords and mapped ClickHouse roles exposed as restricted synthetic groups.
  • Shared SDK-backed JWT/JWKS validation, issuer/audience policy, identity policy, role mapping, and identity-bound caching.
  • Selected-email verification hardening: namespaced fallback emails require verification from the matching namespace; ambiguous fallbacks fail closed.
  • Helm charts, deployment examples, operator documentation, and bounded first-party ClickHouse LDAP compatibility profile.
  • Updated JOSE, crypto, CLI, and Grafana example dependencies.

Verified container images

Both images were built and published for Linux amd64 and arm64 from release commit f9bbd54996524d4dc59384513a70750e2e46ffbc:

ghcr.io/altinity/ch-oauth-ldap:ldap-f9bbd54
ghcr.io/altinity/ch-jwt-verify:sidecar-f9bbd54

Use these immutable commit tags for deployments. This release points to the existing verified artifacts; it does not rebuild or introduce :v0.1.0 container aliases. The sidecar registry requires authenticated access in the current setup.

Verification

  • Required main gate: build, vet, race tests, strict security release tests, and shell-library tests passed.
  • LDAP image publication and sidecar image publication: both architectures and multi-architecture manifests passed.
  • Real ClickHouse acceptance, Docker HA, and committed wire verification passed for 24.8, 25.8, 26.3, and 26.8; all five native LDAP fuzz targets passed.
  • LDAP image registry manifests and version smoke test verified; latest matched the release image at publication.

The certified source and execution qualification are recorded in the wire-profile evidence.

Deployment and compatibility notes

  • LDAP JWT Bind passwords cross the network in plaintext. Keep the service internal and retain the chart's source-restricting NetworkPolicy; network policy is not transport encryption. TLS is not included in this release.
  • The LDAP implementation deliberately supports a bounded ClickHouse wire profile, not a general-purpose directory server.
  • ClickHouse distributed-role behavior has version-specific upstream caveats. See the README and operator guide for configuration and limitations.
  • Tokens previously accepted through an unrelated verification flag or ambiguous fallback email are now rejected intentionally.
Assets 2
Loading