Hello wave I m using pac4j extension to authenticate users I Apache Druid #general

Hello :wave: I'm using pac4j extension to authenti...

jakubmatyszewski

06/04/2024, 8:28 AM

Hello 👋 I'm using pac4j extension to authenticate users. In current implementation if the user is denied access from authentication provider (in this case user is not assigned to the okta group) it ends up with 401 screen. I wonder if that would be possible for this user to fallback to the next authentication method in authentication chain - since I also allow using basic authentication. But I'm not sure if this logic is forced by pac4j itself or we could modify the pac4j-extension logic to cover case like this. Or maybe there is something that I misconfigured? Any ideas?

➕ 1

Kyle Hoondert

06/04/2024, 11:33 AM

have you tried something like

Copy code

druid.auth.authenticator.pac4j.skipOnFailure=true

🙌 1

jakubmatyszewski

06/04/2024, 11:35 AM

Ah, that's a good tip - I got this enabled but only for basic authenticator. Forgot that it's not general option but rather it is set per-authenticator. Will check it out, thanks!

🙌 1

jakubmatyszewski

06/10/2024, 12:12 PM

Still having problem with 401 after Okta authentication with pac4j extension. Unfortunately, I've tried

druid.auth.authenticator.pac4j.skipOnFailure=true

and it doesn't work neither. In router logs I see:

Copy code

2024-06-10T10:58:44,024 ERROR [qtp1022680775-84] org.pac4j.oidc.credentials.extractor.OidcExtractor - Bad authentication response, error=access_denied

And user reports that the same error screen (401) is popping up after logging with Okta, a dead end. This user has access to Okta, but is not assigned to the (druid) app, which results in 401. Relevant piece of common config:

Copy code

druid.auth.authenticatorChain=["MyBasicMetadataAuthenticator", "pac4j", "anonymous"]
    druid.auth.authenticator.pac4j.type=pac4j
    druid.auth.authenticator.pac4j.skipOnFailure=true
    druid.auth.pac4j.cookiePassphrase=testpassphrase
    druid.auth.pac4j.oidc.clientID={{ .auth.okta.clientID }}
    druid.auth.pac4j.oidc.clientSecret={ "type": "environment", "variable": "OIDC_SECRET" }
    druid.auth.pac4j.oidc.discoveryURI={{ .auth.okta.discoveryURI }}
    druid.auth.pac4j.oidc.scope={{ .auth.okta.oidcScope }}

    druid.auth.authorizers=["opaAuthorizer"]
    druid.auth.authorizer.opaAuthorizer.type=opa
    druid.auth.authorizer.opaAuthorizer.opaUri={{ .auth.okta.opaUri}}

    druid.auth.authenticator.pac4j.authorizerName=opaAuthorizer
    druid.auth.authenticator.MyBasicMetadataAuthenticator.authorizerName=opaAuthorizer

    druid.auth.authenticator.anonymous.type=anonymous
    druid.auth.authenticator.anonymous.identity=defaultUser
    druid.auth.authenticator.anonymous.authorizerName=opaAuthorizer

jakubmatyszewski

06/10/2024, 2:19 PM

I've created an issue: https://github.com/apache/druid/issues/16580

jakubmatyszewski

06/10/2024, 2:54 PM

btw @Kyle Hoondert I've just noticed that the

skipOnFailure

is not even implemented in the pac4j extension. 😉 I'd expect it to be somewhere here https://github.com/apache/druid/blob/8e11adfc6f69e6e21d151f6881351465d6a81139/exte[…]/src/main/java/org/apache/druid/security/pac4j/Pac4jFilter.java like in case of the basic authenticator: https://github.com/apache/druid/blob/8e11adfc6f69e6e21d151f6881351465d6a81139/exte[…]druid/security/basic/authentication/BasicHTTPAuthenticator.java

Kyle Hoondert

06/10/2024, 3:15 PM

😮 thanks for letting me know!

Open in Slack

Previous Next