[glasstiger]

Summary

Documents four tandem PRs, all merged and released:

• feat(qwp): add refreshing token providers for Entra ID authentication java-questdb-client#102 (Java client 1.3.11): refreshing token providers and Microsoft Entra ID authentication.
• questdb/questdb-enterprise#1267 (QuestDB Enterprise 4.1.0): OIDC claim fallback lists, JWT issuer validation, and HTTP sessions tied to their credentials.
• fix(core): breaking change 💥 - tie HTTP sessions to their credentials and stop reused JSON parsers growing their copy buffer - OSS tandem questdb#7799 (QuestDB 10.1.0): the open source side of HTTP sessions tied to their credentials.
• fix: fix Web Console hanging or signing out when SSO tokens expire ui#617 (Web Console 2.0.5, bundled with QuestDB 10.1.0): Web Console token renewal and sign-in errors.

Java client

• java.md: new Token providers section. Covers token_provider=azure with the questdb-client-azure artifact, credential selection with azure_credential, AzureTokenSource, and how the Azure provider classifies failures. Also covers RefreshingTokenProvider with TokenSource, ExpiringToken, TokenUnavailableException, its builder options and awaitReady, and custom HttpTokenProvider implementations.
• java.md: How the client handles token failures, by phase: the retry with a new token after a 401, startup, the QuestDB handle, senders that have connected, queries, and orphan drainers.
• java.md: new Connection health section (db.health(), Sender.health(), QwpQueryClient.health()). The handle and builder tables gain connect(String, HttpTokenProvider), health(), and httpTokenProvider(...). Connection-level errors cover QwpAuthFailedException and QwpCredentialUnavailableException.
• connect-string.md: the token_provider, azure_resource, azure_credential, and azure_client_id keys, with recipe and key index rows.
• QWP client behaviour spec: new Authentication failures and token providers reference, with the phase table of the cross-language spec in fix(docs): fix Prometheus counter names #102. The ingress, egress, client failover, and connect string pages no longer describe authentication errors as terminal in every case for Java. Other clients are still described as terminal.

QuestDB Enterprise 4.1.0

• configuration/oidc.md: new acl.oidc.issuer and acl.oidc.issuer.validation.enabled. Claim lists and their startup validation for acl.oidc.sub.claim and acl.oidc.groups.claim. acl.oidc.cache.ttl as the interval for which a session reuses a password check.
• security/oidc.mdx: new User and group claims, Token validation (with the expected issuer and Entra ID v1.0 and v2.0 issuers), Sessions and token expiry, and Troubleshooting sections, and an upgrade warning.
• security/oidc.mdx: new Managed identities and service principals section in the Entra ID guide: app roles, v2.0 access tokens, claim lists, role assignment with az rest, group mapping, and ingestion with the Java client.
• security/rbac.md: new HTTP sessions section: sessions end with their credential, ending Web Console logins with DROP TOKEN TYPE REST, and what replicas keep.
• operations/upgrade.md: Authentication changes in 4.1.0.
• deployment/azure.md: link to the managed identity setup.

QuestDB 10.1.0

• rest-api.md: new HTTP sessions section: session=true and session=false, the qdb_session cookie, and that a rejected credential ends the session.
• http-server.md: new http.session.timeout entry.

Web Console

• security/oidc.mdx: Web Console token renewal, covering renewal from the exp claim of the ID token, the resend after a 401, Missing ID token, and failed renewals with the Sign in again warning. Also Web Console sign-in errors.

Also changed

• java.md: corrected the error categories and policies, that the QuestDB builder accepts an error handler, and added the AUTH_FAILED connection event.
• acl.oidc.groups.claim has no default and is required.
• The Entra ID example takes the principal from preferred_username instead of the display name, name.
• A login without groups is rejected, not authenticated without permissions.
• Notes the 4.1.0 limitation, from its release notes, that ingestion cannot create tables or add columns for external users.
• Changelog entries for October 2026.

Dependencies

None open: Java client 1.3.11, QuestDB 10.1.0, and QuestDB Enterprise 4.1.0 are released, and include all four PRs.

[github-actions]

🚀 Build success!

Latest successful preview: https://preview-575--questdb-documentation.netlify.app/docs/

Commit SHA: 33efeaf

📦 Build generates a preview & updates the link on each commit.