Does ShardingSphere Proxy support end-user identity propagation to backend databases?

[alexalves83]

Hello,

We're evaluating ShardingSphere Proxy for enterprise usage with Apache Doris.

Our requirement is end-user identity propagation.

Example:

alex.alves -> ShardingSphere Proxy -> Doris (alex.alves)
maria.silva -> ShardingSphere Proxy -> Doris (maria.silva)

instead of:

alex.alves -> ShardingSphere Proxy -> Doris (shared service account)

Our goals are:

• Database audit logs showing the original user
• User-level permissions managed in Doris
• Resource usage attributed to the original user
• Compliance and auditing requirements

Does ShardingSphere Proxy currently support:

• User impersonation
• Identity passthrough
• Backend credential delegation
• Per-user backend connections

for MySQL-compatible databases such as Apache Doris?

If not currently supported, is this feature planned on the roadmap?

Thank you.

[terrymanu]

Hi @alexalves83, thanks for the question.

Current ShardingSphere-Proxy does not support propagating a frontend user's identity or credentials to a backend storage database. This is best classified as a question about an unsupported capability, not a bug.

Proxy authentication and backend database authentication are separate:

• authority.users authenticates users to the ShardingSphere compute node and controls access to logical databases.
• Each storage data source has its own configured JDBC username and password.
• After frontend authentication, Proxy records the user as a session Grantee, but the backend connection API has no user or credential parameter, and JDBCBackendDataSource obtains connections from the configured data source pool.

Therefore, Doris sees the storage-unit account configured in ShardingSphere, not alex.alves or maria.silva. User impersonation, identity passthrough, backend credential delegation, and backend connections authenticated as each frontend user are not supported. The Doris Proxy plugin provides dialect and compatibility adaptation; it does not change this credential model.

We also could not find a public issue, PR, or linked roadmap item that commits to this capability, so we cannot provide a planned version. Please use Proxy authority for Proxy-level access control and treat the backend credential as a storage service account. If native Doris audit logs, permissions, and resource attribution must use the original end-user identity, current ShardingSphere-Proxy does not meet that requirement.