This message was deleted.

Also it seems that the

PasswordProvider

approach doesn't work either:

druid.escalator.internalClientPassword={"type":"environment","variable":"LDAP_INTERNAL_PASSWORD"}
    druid.escalator.internalClientUsername={"type":"environment","variable":"LDAP_INTERNAL_USER"}
    druid.auth.authenticator.ldap.initialAdminPassword={"type":"environment","variable":"LDAP_ADMIN_PASSWORD"}
    druid.auth.authenticator.ldap.initialInternalClientPassword={"type":"environment","variable":"LDAP_INTERNAL_PASSWORD"}
    druid.auth.authenticator.ldap.credentialsValidator.bindPassword={"type":"environment","variable":"LDAP_ADMIN_PASSWORD"}
    druid.auth.authenticator.ldap.credentialsValidator.bindUser={"type":"environment","variable":"LDAP_ADMIN_USER"}

Here we get:

used by: com.fasterxml.jackson.databind.exc.MismatchedInputException: Cannot deserialize instance of `java.lang.String` out of START_OBJECT token                                                                                                                                                                                                 │
│  at [Source: UNKNOWN; line: -1, column: -1] (through reference chain: org.apache.druid.security.basic.authentication.BasicHTTPEscalator["internalClientUsername"])                                                                                                                                                                                  │
│     at com.fasterxml.jackson.databind.exc.MismatchedInputException.from(MismatchedInputException.java:59)                                                                                                                                                                                                                                           │
│     at com.fasterxml.jackson.databind.DeserializationContext.reportInputMismatch(DeserializationContext.java:1445)                                                                                                                                                                                                                                  │...

It's supposed to work for the password ones, but not for

bindUser

Thank you, we removed the user names from the dynamic config and left only password properties, but that unfortunately didn't change anything.

do you get a different error once you do that? the ones you posted initially mentioned username-related parameters