Security#
In this section of our reference documentation, learn about the basic workflows for securing your Starburst Enterprise platform (SEP) cluster.
Security topic areas#
There are three main types of security measures for SEP clusters:
User authentication and client security
Security inside the cluster
Security between the cluster and data sources
Built-in access control offer the most convenient way to configure security for the connected data sources as well as the features in the Starburst Enterprise web UI .
This section provides reference material for each of these security types. Not sure where to start? Review our Security overview to get started.
Built-in access control#
SEP provides a built-in, role-based access control system that is integrated with the Starburst Enterprise web UI. This system makes it easy to configure any user’s correct access rights to catalogs, schemas, and tables, as well as to elements of the UI itself.
- Built-in access control overview
- Built-in access control roles
- Built-in access control privileges
- Built-in access control masks and filters
- Built-in access control audit log
- Comparison to Apache Ranger
- Built-in access control configuration
- Enable multiple access control systems
- Access control framework
- Migrating to built-in access control
- Using BIAC with Iceberg materialized views
- API
- SQL support and limitations
User authentication and client security#
When setting up a new cluster, start with simple password file authentication. Once access to your cluster is secured, SEP provides a number of production-level options for authenticating users such as LDAP, Okta or OAuth 2.0. SEP also offers several options for delegated authorization. These pass-through features guarantee that SEP uses the same token as a user directly accessing a data source.
- Authentication types
- Password files
- LDAP
- LDAP group provider
- SCIM user and group synchronization
- Salesforce
- OAuth2 over HTTPS
- OAuth2 providers
- SAML 2.0 over HTTPS
- Okta
- Kerberos
- Certificate
- JWT
- Header
- Password pass-through
- OAuth 2.0 token pass-through
- Kerberos credential pass-through
- Multiple authentication types
- Multiple password authenticators
- Multiple header authenticators
Once authenticated, users are authorized by one of SEP’s available access control systems, including our comprehensive built-in access control.
Client security is covered in our clients documentation.
Cluster security#
Cluster security topics cover both securing external client access to your SEP cluster, and internal communications between cluster resources. Secrets are available for use in any configuration file throughout SEP to provide a secure means of managing values such as usernames, passwords and other strings used in the cluster through your provisioning system.
Third-party access control#
If your organization uses Ranger, Privacera, or Immuta, SEP integrates with those access control systems.
Miscellaneous security options#
Learn about other security options that may apply to your environment.
