This message was deleted Apache Druid #general

Join Slack

This message was deleted.

# general

Slackbot

03/28/2023, 1:07 PM

This message was deleted.

Sachidananda

03/28/2023, 1:07 PM

Copy code

# Druid basic security
druid.auth.authenticatorChain=["MyBasicMetadataAuthenticator"]
druid.auth.authenticator.MyBasicMetadataAuthenticator.type=basic

# Default password for 'admin' user, should be changed for production.
druid.auth.authenticator.MyBasicMetadataAuthenticator.initialAdminPassword=password1

# Default password for internal 'druid_system' user, should be changed for production.
druid.auth.authenticator.MyBasicMetadataAuthenticator.initialInternalClientPassword=password2

# Uses the metadata store for storing users, you can use authentication API to create new users and grant permissions
druid.auth.authenticator.MyBasicMetadataAuthenticator.credentialsValidator.type=metadata

# If true and the request credential doesn't exists in this credentials store, the request will proceed to next Authenticator in the chain.
druid.auth.authenticator.MyBasicMetadataAuthenticator.skipOnFailure=false
druid.auth.authenticator.MyBasicMetadataAuthenticator.authorizerName=MyBasicMetadataAuthorizer

using this along with extension

Gian Merlino

03/28/2023, 3:07 PM

first thing i would check is whether your Coordinator is healthy? if it is healthy then next i would check to make sure the same config is present on all servers

Tejas Parbat

03/28/2023, 4:46 PM

Please try sample configs from https://gist.github.com/davidagee/c0c839cd23f047b838e8a3ea73320346 looks like few configs are missing as per pasted configs

👍 1

Sachidananda

03/29/2023, 8:33 AM

i needed to add escalator configs also then it worked

Tejas Parbat

03/29/2023, 8:34 AM

Yeah right !

Tejas Parbat

03/29/2023, 8:38 AM

here are some basic security examples Managing Users Listing users Check for current users to be authenticated using basic security:

Copy code

curl -XGET -H'Content-Type: application/json' -uadmin:Pass_From_APISection -k <https://localhost:8281/druid-ext/basic-security/authentication/db/basic/users>

["admin","John"]

Create user Create users needed using an API similar to the following:

Copy code

curl -XPOST -H'Content-Type: application/json' -uadmin:Pass_From_APISection -k <https://localhost:8281/druid-ext/basic-security/authentication/db/basic/users/john>

Set user password

Copy code

curl -XPOST -H'Content-Type: application/json' -d @password.json -uadmin:Pass_From_APISection -k <https://localhost:8281/druid-ext/basic-security/authentication/db/{authenticatorName}/users/john/credentials>

password.json: { "password": "Imply-123" } Delete user

Copy code

curl -XDELETE -H'Content-Type: application/json' -uadmin:Pass_From_APISection -k <https://localhost:8281/druid-ext/basic-security/authentication/db/basic/users/john>

Describe user Short Authentication Description

Copy code

curl -XGET -H'Content-Type: application/json' -uadmin:Pass_From_APISection -k <https://localhost:8281/druid-ext/basic-security/authentication/db/basic/users/admin>

{"name":"admin","credentials":{"salt":"aUYFxrSb1PuyklsI/WUg629HxOi73cbl7vrehzZ13Ik=","hash":"3la9loHU1NgEcJHiUcp6BzqcXvhqZxspMegYy/93xawZhxalJYmN2aHbjhs6u4zGggo0+typaBqex89Nmo7Vcw==","iterations":10000}}

Short Authorization Description

Copy code

curl -XGET -H'Content-Type: application/json' -uadmin:Pass_From_APISection -k <https://localhost:8281/druid-ext/basic-security/authorization/db/basic/users/admin>

{"name":"admin","roles":["admin"]}

Full Authorization Description

Copy code

curl -XGET -H'Content-Type: application/json' -uadmin:Pass_From_APISection -k <https://localhost:8281/druid-ext/basic-security/authorization/db/basic/users/admin?full>

{

"name": "admin",

"roles": [{

"name": "admin",

"permissions": [{

"resourceAction": {

"resource": {

"name": ".*",

"type": "DATASOURCE"

},

"action": "READ"

},

"resourceNamePattern": ".*"

}, {

"resourceAction": {

"resource": {

"name": ".*",

"type": "DATASOURCE"

},

"action": "WRITE"

},

"resourceNamePattern": ".*"

}, {

"resourceAction": {

"resource": {

"name": ".*",

"type": "CONFIG"

},

"action": "READ"

},

"resourceNamePattern": ".*"

}, {

"resourceAction": {

"resource": {

"name": ".*",

"type": "CONFIG"

},

"action": "WRITE"

},

"resourceNamePattern": ".*"

}, {

"resourceAction": {

"resource": {

"name": ".*",

"type": "STATE"

},

"action": "READ"

},

"resourceNamePattern": ".*"

}, {

"resourceAction": {

"resource": {

"name": ".*",

"type": "STATE"

},

"action": "WRITE"

},

"resourceNamePattern": ".*"

}]

}]

}

Roles List roles

Copy code

curl -XGET -H'Content-Type: application/json' -uadmin:Pass_From_APISection -k <https://localhost:8281/druid-ext/basic-security/authorization/db/basic/roles/>

["admin","druid_system","dataGrip"]

Create Role

Copy code

curl -XPOST -H'Content-Type: application/json'  -uadmin:Pass_From_APISection -k <https://localhost:8281/druid-ext/basic-security/authorization/db/basic/roles/dataGrip>
curl -XGET -H'Content-Type: application/json'  -uadmin:Pass_From_APISection -k <https://localhost:8281/druid-ext/basic-security/authorization/db/basic/roles>

["admin","druid_system","dataGrip"]

Assign Permissions to role

Copy code

curl -XPOST -H'Content-Type: application/json' -d @role_permissions.json -uadmin:Pass_From_APISection -k <https://localhost:8281/druid-ext/basic-security/authorization/db/basic/roles/dataGrip/permissions>

role_permission.json:

Copy code

[

{

  "resource": {

    "name": "wiki.*",

    "type": "DATASOURCE"

  },

  "action": "READ"

},

{

  "resource": {

    "name": "wikiticker",

    "type": "DATASOURCE"

  },

  "action": "WRITE"

}

]

Modify Role Permissions Get the current Role Permissions

Copy code

curl -XGET -H'Content-Type: application/json' -uadmin:Pass_From_APISection -k <https://localhost:8281/druid-ext/basic-security/authorization/db/basic/roles/dataGrip/permissions>

[{

"resourceAction": {

"resource": {

"name": "wiki.*",

"type": "DATASOURCE"

},

"action": "READ"

},

"resourceNamePattern": "wiki.*"

}, {

"resourceAction": {

"resource": {

"name": "wikiticker",

"type": "DATASOURCE"

},

"action": "WRITE"

},

"resourceNamePattern": "wikiticker"

}]

Currently, user jonh with dataGrip role would be able to only read / write datasources with names starting with wiki.. Trying to access datasources with name druidKafka would fail with the following error: [00000][-1] Error -1 (00000) : Error while executing SQL "select * from druid.druidKafka1": Remote driver error: RuntimeException: org.apache.druid.server.security.ForbiddenException: Allowed:false, Message: -> ForbiddenException: Allowed:false, Message: To give permission to datasources by name druidKafka*, role_permissions.json role_permissions.json file needs to be modified. Copy the above to a file and amend/add permissions. For example, create a file called role_permission.json:

Copy code

[

{

  "resource": {

    "name": "druid.*",

    "type": "DATASOURCE"

  },

  "action": "READ"

},

{

  "resource": {

    "name": "druidKafka.*",

    "type": "DATASOURCE"

  },

  "action": "WRITE"

}

]

NOTE: resourcePatternName is removed from the Json while saving. Run the following command to change the permissions for dataGrip role using the above json file:

Copy code

curl -XPOST -H'Content-Type: application/json' -d @role_permission.json -uadmin:Pass_From_APISection -k <https://localhost:8281/druid-ext/basic-security/authorization/db/basic/roles/dataGrip>

Check the role Permissions

Copy code

curl -XGET -H'Content-Type: application/json' -uadmin:Pass_From_APISection -k <https://localhost:8281/druid-ext/basic-security/authorization/db/basic/roles/dataGrip/permissions>

[{"resourceAction":{"resource":{"name":"druid.*","type":"DATASOURCE"},"action":"READ"},"resourceNamePattern":"druid.*"},{"resourceAction":{"resource":{"name":"druidKafka.*","type":"DATASOURCE"},"action":"WRITE"},"resourceNamePattern":"druidKafka.*"}]

Try to access the tables as user john now. Accessing druidKafka1: [00000][-1] Error -1 (00000) : Error while executing SQL "select count(*) from *druidKafka1*": Remote driver error: RuntimeException: org.apache.druid.server.security.ForbiddenException: Allowed:false, Message: -> ForbiddenException: Allowed:false, Message: Accessing druidKinesis1: select count(*) from druidKinesis1 7743372 Query successfully completed. Delete Role

Copy code

curl -XDELETE -H'Content-Type: application/json' -uadmin:Pass_From_APISection -k <https://localhost:8281/druid-ext/basic-security/authorization/db/basic/roles/dataGrip>

List Roles after Deletion:

Copy code

curl -XGET -H'Content-Type: application/json' -uadmin:Pass_From_APISection -k <https://localhost:8281/druid-ext/basic-security/authorization/db/basic/roles/>

["admin","druid_system"]imply@ip-10-2-203-157:~$

Managing User with Roles List User Roles

Copy code

curl -XGET -H'Content-Type: application/json' -uadmin:Pass_From_APISection -k <https://localhost:8281/druid-ext/basic-security/authorization/db/basic/users/admin>

{"name":"admin","roles":["admin"]}

Associate user for Authorization Once a user is created using the commands above, it can be enabled for Authorization.

Copy code

curl -XPOST -H'Content-Type: application/json' -uadmin:Pass_From_APISection -k <https://localhost:8281/druid-ext/basic-security/authorization/db/basic/users/john>

{"error":"User [john] already exists."}

Assign Role to a User

Copy code

curl -XPOST -H'Content-Type: application/json' -uadmin:Pass_From_APISection -k <https://localhost:8281/druid-ext/basic-security/authorization/db/basic/users/john/roles/admin>

Remove Role from a user

Copy code

curl -XDELETE -H'Content-Type: application/json' -uadmin:Pass_From_APISection -k <https://localhost:8281/druid-ext/basic-security/authorization/db/basic/users/john/roles/admin>

Tejas Parbat

03/29/2023, 8:39 AM

API examples*

2 Views

Open in Slack

Previous Next