This message was deleted.

hello. The

/users/<user_id>/credentials

API is specifically used to change the credentials for the specified user. So I think not logging any sensitive information is intentional. However, an authorized user with the right roles can use the user management APIs to query users and their roles. For example:

curl -u @creds.json -X GET http://<master_host>:8081/druid-ext/basic-security/authorization/db/MyBasicMetadataAuthorizer/users

curl -u @creds.json -X GET <http://localhost:8081/druid-ext/basic-security/authorization/db/MyBasicMetadataAuthorizer/users/foo>

Hi @Abhinav Raghuvanshi Thank you, even the user management request like create or delete user is also not logged. Wondering if this is expected.