Hi @madeleine_corneli ,
We give each human two users in Exasol, one for when they connect from an AI-related app (e.g. via MCP) and one when connecting from a non-AI app or directly. When connecting from an AI-ish app we want them to have a different (much tighter) security model.
Currently Exasol ignores openid token scopes when authenticating via OpenID. It would be useful it it took them into account such that it would authenticate as different Exasol users depending on the token scope + subject rather than using the subject alone.
This way a human accessing Exasol via an AI pathway would auth via an OpenID token having, say, an “ai” scope and Exasol would assign that to user “john_ai” where as with a scope of “cli” it would assign to user “john_cli”. And those two users would have different roles in Exasol.
Perhaps something like:
CREATE USER john_ai IDENTIFIED BY OPENID SUBJECT ‘john’ SCOPE ‘ai’;
CREATE USER john_cli IDENTIFIED BY OPENID SUBJECT ‘john’ SCOPE ‘cli’;
CREATE USER john IDENTIFIED BY OPENID SUBJECT ‘john’; – fallback to this user if no scoped users match
I’m interested to hear your thoughts or suggestions for a better way to handle it.
Regards
Peter