Manticore Search Adds Built-in Authentication and Authorization Starting with Version 27.1.5
Manticore Search has added built-in authentication and authorization starting with release 27.1.5. The new functionality applies to SQL connections over the MySQL protocol, HTTP and HTTPS endpoints, and replication-related operations.
Authentication answers the question of who is making the request, while authorization determines what actions that user is allowed to perform. Existing SQL and HTTP clients retain their usual connection patterns, requiring only minimal changes in applications.
New Capabilities in Manticore Search
The release includes several authentication methods and permission controls:
- SQL/MySQL authentication using passwords with mysql_native_password
- HTTP Basic authentication using the same username and password
- HTTP Bearer tokens for scenarios where passwords should not be sent with every request
- Permissions for five distinct actions: read, write, schema, replication, and admin
- Targets that can be specified as exact names such as products, wildcard patterns like logs_*, or global scopes such as *
- SQL commands for managing users, tokens, and rights
- Authentication logging with levels disabled, error, warning, info, all, and trace (default is info)
The access model is intentionally compact. Administrators create users, assign minimal necessary rights, update client applications to send credentials, and verify that unauthorized operations are rejected.
Enabling Authentication
Authentication is activated through the auth parameter in the searchd section of the configuration file. In RT mode, set auth = 1 to store data in auth.json within the data_dir directory. In plain mode, provide an explicit path to the authentication file. SSL for SQL connections and HTTPS for HTTP clients are required when transmitting passwords or tokens. Access to the auth.json file must be strictly limited.
Initializing the First Administrator and Managing Users
After enabling auth and starting searchd, the first administrator is created using the --auth or --auth-non-interactive flag. Subsequent users are created with commands such as CREATE USER, followed by GRANT statements that assign specific actions to targets. The TOKEN command issues or reissues Bearer tokens, while SET PASSWORD updates credentials used for Basic and MySQL authentication. SHOW TOKEN allows verification of token existence without exposing the secret value.
Client Connection Examples
MySQL clients authenticate with the Manticore username and password. HTTP clients can use either Basic authentication or Bearer tokens. Both methods result in the same permission evaluation: the user is identified and the requested action is checked against assigned rights.
Testing and Phased Rollout
After enabling authentication, administrators should verify both successful authorized operations and expected denials, which return HTTP 403 Forbidden or MySQL error 1045. Explicit deny rules created with WITH ALLOW 0 take precedence over more specific grants. For production systems, a staged rollout is recommended: inventory all clients, enable auth on staging, create least-privilege users, update application code, test both success and failure cases, and gradually deploy changes while rotating credentials.
Additional considerations apply to distributed tables and replication clusters, where matching authentication data must exist on remote nodes and the replication action must be granted appropriately.
Related articles
88% of Enterprises Run AI Agents but Fewer Than 10% Generate Profits, Ronglian Cloud Reports at WAIC Forum
At the 2026 World Artificial Intelligence Conference, Ronglian Cloud highlighted that while 88% of companies have deployed internal AI Agents, fewer than 10% have achieved meaningful revenue from them. The company, which originated from call center and contact platform services serving tens of thousands of enterprises, organized the fourth WAIC Enterprise Agent Forum focused on evolution and commercial landing. Executives from retail, finance, and electronic signature sectors emphasized that buyers now demand proven ROI rather than token consumption metrics or experimental features. Ronglian Cloud outlined a four-stage maturity model ranging from basic Copilot assistance to fully autonomous business loops, noting most organizations remain stuck between stages two and three. The firm is shifting its own model toward effect-based payments and KPI-driven Agent performance in scenarios such as collections and private-domain operations, where one Agent can manage hundreds of thousands of customers at a fraction of human cost.
OAuth Authorization Server Built Without Storing User Profiles
The article details the evolution of an OAuth Authorization Server that deliberately avoids storing user profiles, relying instead on external identity providers for authentication. It addresses three core constraints: hundreds of dynamically created isolated APIs, a public SPA client without a BFF, and the inability of resources to query the AS on every request. The design separates concerns so the AS handles only clients, tenants, grants, audiences, scopes, keys, sessions, and token issuance while the Main API owns profiles and roles. Tokens are managed securely inside a Service Worker using a custom FedCM grant, eliminating races across tabs and reducing XSS exposure. The approach minimizes blast radius, simplifies compliance, and keeps the AS replaceable without affecting product domain logic.
Why a 202-Character License Key Uses ECDSA P-256 Instead of Ed25519 or RSA
A developer building offline license verification for a .NET desktop application evaluated Ed25519, RSA, and ECDSA P-256 before selecting the last option. The decision was driven by the requirement for zero external dependencies, keys short enough for manual entry from email, and support for key rotation without breaking existing licenses. Although Ed25519 offers faster verification and a smaller public key, it is absent from System.Security.Cryptography in both .NET 8 and .NET 10, with API approval only targeted for version 11. RSA-2048 produces signatures too long for practical use, resulting in a 571-character Base32 string that users would find cumbersome. ECDSA P-256 with SHA-256 delivers a fixed 64-byte signature that becomes a manageable 202-character key when encoded in Base32, while remaining fully available in the runtime. The article also covers performance measurements, the risks of ECDSA nonce generation, and the deliberate choice of the IEEE P1363 signature format to guarantee fixed-length output.
Pilcrow Publishes Free Comprehensive Guide on Web Authentication
Author Pilcrow has released a detailed, ad-free handbook covering authentication and authorization practices for web applications. The resource draws on personal experience and includes practical examples in JavaScript and Go. It examines password-based methods, email verification, multi-factor authentication, passwordless flows, and passkeys while highlighting associated risks and usability trade-offs. The book also provides in-depth guidance on session management, token security, expiration policies, and email address handling as account identifiers. Recommendations emphasize choosing methods that match application security requirements and user expectations. Additional context is given on OWASP resources and community support channels.