Antalya 25.8 Backport of #70775: Add feature to impersonate/proxy user sessions

[mkmkme]

25.8.15 Backport of ClickHouse#70775: Add feature to impersonate/proxy user sessions

Same as #1340, but for Antalya 25.8

Changelog category (leave one):

• New Feature

Changelog entry (a user-readable short description of the changes that goes to CHANGELOG.md):

Added new SQL statement EXECUTE AS to support user impersonation (ClickHouse#70775 by @shiyer7474, ClickHouse#90437 by @alexbakharew)

Documentation entry for user-facing changes

...

CI/CD Options

Exclude tests:

• Fast test
• Integration Tests
• Stateless tests
• Stateful tests
• Performance tests
• Aarch64 tests
• All with ASAN
• All with TSAN
• All with MSAN
• All with UBSAN
• All with Coverage
• All Regression
• Disable CI Cache

Regression jobs to run:

• Fast suites (mostly <1h)
• Aggregate Functions (2h)
• Alter (1.5h)
• Benchmark (30m)
• ClickHouse Keeper (1h)
• Iceberg (2h)
• LDAP (1h)
• OAuth (5m)
• Parquet (1.5h)
• RBAC (1.5h)
• SSL Server (1h)
• S3 (2h)
• S3 Export (2h)
• Swarms (30m)
• Tiered Storage (2h)

[mkmkme]

Tested locally, all the related tests are passing. I'll put self-verification once CI finishes

[github-actions]

Workflow [PR], commit [63768dd]

[mkmkme]

@blau-ai

[blau-ai]

CI triage

Verdict: 0 of the failures are caused by this PR. All red checks are pre-existing / environment-flaky suites that exercise object storage, the Iceberg data-lake and multi-node swarms — none of them touch the code paths this backport changes (EXECUTE AS / impersonation lives in Access/, Parsers/Access/, Interpreters/Access/, Functions/authenticatedUser.cpp). Notably, the feature's own new stateless test 03252_execute_as PASSED. No action needed on the PR; the failing checks just need re-runs (or are known-flaky infra).

Evidence per check below.

---

1. Stateless tests (amd_debug, AsyncInsert, s3 storage, parallel) — Failed: 1, Broken: 2 — NOT PR-caused

The GHA job itself concluded success; the shard is flagged red by two object-storage tests:

03572_export_merge_tree_part_to_object_storage:   [ FAIL ]   68.57 sec.
03441_deltalake_clickhouse_public_datasets:        [ BROKEN ] 65.29 sec.
  Marked as broken: INVESTIGATE - S3 sometimes unreachable

Both are S3 / object-storage tests. 03441 is explicitly marked broken for flaky S3 reachability. 03572 (added by an unrelated Antalya PR, #1550) exports MergeTree parts to object storage — again pure object-storage, unrelated to EXECUTE AS. This shard forces all storage through S3 (s3 storage), so transient S3 blips surface here.
Next step: re-run the shard; 03441 is a documented flaky.

2. Regression x86 swarms / RegressionTestsRelease / Swarms — NOT PR-caused

Failing scenarios are all distributed-cluster resiliency tests:

[ Fail ] /swarms/feature/node failure/check restart swarm node
[ Fail ] /swarms/feature/node failure/swarm out of disk space
[ Fail ] /swarms/feature/swarm joins
[ Fail ] /swarms/feature/feature/object storage cluster profile events with overloaded node

Root cause in the log is a network drop between cluster nodes, not an assertion about behavior:

Code: 210. DB::Exception: Connection reset by peer, while reading from socket
(peer: 172.18.0.6:9000 ... while receiving packet from clickhouse3:9000) ... (NETWORK_ERROR)

This is multi-node network/infra flakiness in the swarms suite; it has no relationship to access-control changes.
Next step: re-run Swarms.

3. Regression x86 iceberg_1 / iceberg_2 / RegressionTestsRelease / Iceberg — NOT PR-caused

Failing scenarios are Iceberg data-lake engine tests:

[ Fail ] /iceberg/iceberg engine/glue catalog/position delete reads/read position deletes
[ Fail ] /iceberg/iceberg table engine/feature/position delete smoke
[ Fail ] /iceberg/iceberg table engine/feature/compaction smoke

These depend on external object storage / AWS Glue catalog and are unrelated to this diff. The base branch antalya-25.8 itself has recent red ReleaseBranchCI runs, so these suites are not green there either.
Next step: re-run Iceberg; treat as pre-existing suite instability unless it reproduces green-vs-red against the base.

4. FinishCIReport / PR — aggregate gates

These are roll-up gates; they are red only because of checks 1–3 above. No independent failure.

---

Bottom line: this is a clean backport from the CI-signal standpoint — the impersonation code compiled on every build variant, integration/fast/AST-fuzzer/BuzzHouse/compatibility/grype all passed, and the feature's own test 03252_execute_as passed. The remaining red is object-storage / Iceberg / swarms environment flakiness selected by the PR's regression checkboxes. Recommend re-running the three regression jobs + the stateless shard; no code change is warranted.

_{🤖 Automated CI triage by @blau-ai. Log evidence pulled from run 30992153392. I can't build/run ClickHouse in this container, so this is static + CI-log analysis, not a local reproduction.}