https://linen.dev logo
Join Slack
Powered by
This message was deleted.
# troubleshooting
s
This message was deleted.
t
@Satish N are you using initial admin user credentials? seems credentials issue
Also make sure the ldap user created at druid side with ref https://support.imply.io/hc/en-us/articles/360041635193-Druid-LDAP-and-Active-Directory-AD-Integration- Once security is configured to authenticate the LDAP the user will only verify the user password with LDAP. One of the prerequisites is to add the LDAP user to Druid.
s
@Tejas Parbat i am using the below config and initial commands ldapwhoami and ldapsearch working fine. druid.auth.authenticatorChain=["ldap"] druid.auth.authenticator.ldap.type=basic druid.auth.authenticator.ldap.enableCacheNotifications=true druid.auth.authenticator.ldap.credentialsValidator.type=ldap druid.auth.authenticator.ldap.credentialsValidator.url=ldap://ldapaddress:389 druid.auth.authenticator.ldap.credentialsValidator.bindUser=user1 druid.auth.authenticator.ldap.credentialsValidator.bindPassword=<user1password> druid.auth.authenticator.ldap.credentialsValidator.baseDn=dc=<domain>,dc=com druid.auth.authenticator.ldap.credentialsValidator.userSearch=(sAMAccountName=druid-bind) druid.auth.authenticator.ldap.credentialsValidator.userAttribute=sAMAccountName druid.auth.authenticator.ldap.authorizerName=ldapauth druid.escalator.type=basic druid.escalator.internalClientUsername=<user1> druid.escalator.internalClientPassword=<user1password> druid.escalator.authorizerName=ldapauth druid.auth.authorizers=["ldapauth"] druid.auth.authorizer.ldapauth.type=basic druid.auth.authorizer.ldapauth.initialAdminUser=< tried with both user1 and admin> druid.auth.authorizer.ldapauth.initialAdminRole= <AD group the user1 belongs) druid.auth.authorizer.ldapauth.roleProvider.type=ldap druid.auth.authorizer.ldapauth.initialAdminPassword=<Tried with user1 password and admin passowrord) With the above options still i am getting the below error while creating the role curl -X POST http://localhost:8081/druid-ext/basic-security/authorization/db/ldapauth/roles/new_role -u admin:<admin passowrd> <html> <head> <meta http-equiv="Content-Type" content="text/html;charset=utf-8"/> <title>Error 401 User authentication failed.</title> </head> <body><h2>HTTP ERROR 401 User authentication failed.</h2> <table> <tr><th>URI:</th><td>/druid-ext/basic-security/authorization/db/ldapauth/roles/new_role</td></tr> <tr><th>STATUS:</th><td>401</td></tr> <tr><th>MESSAGE:</th><td>User authentication failed.</td></tr> <tr><th>SERVLET:</th><td>default</td></tr> </table> </body> </html>
s
Hi @Satish N, I know this doc has been revamped recently. I have not done this before, but from the description it seems like Steps 4-6 are critical particularly if you have a different user for druid.escalator credentials. Did that step succeed?
s
@Sergio Ferragut & @Tejas Parbat i am following the https://druid.apache.org/docs/0.22.1/operations/auth-ldap.html#enable-ldap-in-druid( The version of of druid we are on ). Basically i am able to create the role with Basic authentication and assign the permissions (Steps 1 and 2) but when i am trying to assign the group mappings to ldapgroup (Step 3) . Giving me the below error [druid@ ~]$ cat groupmap.json { "name": "G_DruidUsersmap", "groupPattern": "CN=G_DruidUsers(ldapgroupname),OU=File Server Groups,OU=Groups,OU=Corporate,DC=<domain>,DC=com "roles": [ "druid_role" ] } [druid@~]$ curl -i -v -H "Content-Type: application/json" -u druid-bind -X POST -d @groupmap.json http://localhost:8081/druid-ext/basic-security/authorization/db/ldapauth/groupMappings/G_DruidUsersmap Enter host password for user 'druid-bind': * About to connect() to localhost port 8081 (#0) * Trying 127.0.0.1... * Connected to localhost (127.0.0.1) port 8081 (#0) * Server auth using Basic with user 'druid-bind'
POST /druid-ext/basic-security/authorization/db/ldapauth/groupMappings/G_DruidUsersmap HTTP/1.1
Authorization: Basic ZHJ1aWQtYmluZDpMOW5AaiQ3QXIjMEY1bEI=
User-Agent: curl/7.29.0
Host: localhost:8081
Accept: /
Content-Type: application/json
Content-Length: 162
* upload completely sent off: 162 out of 162 bytes < HTTP/1.1 401 Unauthorized HTTP/1.1 401 Unauthorized < Cache-Control: must-revalidate,no-cache,no-store Cache-Control: must-revalidate,no-cache,no-store < Content-Type: text/html;charset=iso-8859-1 Content-Type: text/html;charset=iso-8859-1 < Content-Length: 447 Content-Length: 447 < <html> <head> <meta http-equiv="Content-Type" content="text/html;charset=utf-8"/> <title>Error 401 Unauthorized</title> </head> <body><h2>HTTP ERROR 401 Unauthorized</h2> <table> <tr><th>URI:</th><td>/druid-ext/basic-security/authorization/db/ldapauth/groupMappings/G_DruidUsersmap</td></tr> <tr><th>STATUS:</th><td>401</td></tr> <tr><th>MESSAGE:</th><td>Unauthorized</td></tr> <tr><th>SERVLET:</th><td>default</td></tr> </table> </body> </html> * Connection #0 to host localhost left intact --When i am trying to create the group using ldap authentication i am getting the below error curl -i -v -H "Content-Type: application/json" -u druid-bind -X POST http://localhost:8081/druid-ext/basic-security/authorization/db/ldapauth/roles/readRole Enter host password for user 'druid-bind': * About to connect() to localhost port 8081 (#0) * Trying 127.0.0.1... * Connected to localhost (127.0.0.1) port 8081 (#0) * Server auth using Basic with user 'druid-bind'
POST /druid-ext/basic-security/authorization/db/ldapauth/roles/readRole HTTP/1.1
Authorization: Basic ZHJ1aWQtYmluZDpMOW5AaiQ3QXIjMEY1bEI=
User-Agent: curl/7.29.0
Host: localhost:8081
Accept: /
Content-Type: application/json
< HTTP/1.1 401 Unauthorized HTTP/1.1 401 Unauthorized < Cache-Control: must-revalidate,no-cache,no-store Cache-Control: must-revalidate,no-cache,no-store < Content-Type: text/html;charset=iso-8859-1 Content-Type: text/html;charset=iso-8859-1 < Content-Length: 432 Content-Length: 432 < <html> <head> <meta http-equiv="Content-Type" content="text/html;charset=utf-8"/> <title>Error 401 Unauthorized</title> </head> <body><h2>HTTP ERROR 401 Unauthorized</h2> <table> <tr><th>URI:</th><td>/druid-ext/basic-security/authorization/db/ldapauth/roles/readRole</td></tr> <tr><th>STATUS:</th><td>401</td></tr> <tr><th>MESSAGE:</th><td>Unauthorized</td></tr> <tr><th>SERVLET:</th><td>default</td></tr> </table> </body> </html> * Connection #0 to host localhost left intact -- This is my ldap config druid.auth.authenticatorChain=["ldap"] druid.auth.authenticator.ldap.type=basic druid.auth.authenticator.ldap.enableCacheNotifications=true druid.auth.authenticator.ldap.credentialsValidator.type=ldap druid.auth.authenticator.ldap.credentialsValidator.url=ldap://<ldap address>:389 druid.auth.authenticator.ldap.credentialsValidator.bindUser=druid-bind@domain.com druid.auth.authenticator.ldap.credentialsValidator.bindPassword=<password> druid.auth.authenticator.ldap.credentialsValidator.baseDn=dc=<domain>,dc=com druid.auth.authenticator.ldap.credentialsValidator.userSearch=(sAMAccountName=druid-bind) druid.auth.authenticator.ldap.credentialsValidator.userAttribute=sAMAccountName druid.auth.authenticator.ldap.authorizerName=ldapauth druid.escalator.type=basic druid.escalator.internalClientUsername=druid-bind@<domain>.com druid.escalator.internalClientPassword=<password> druid.escalator.authorizerName=ldapauth druid.auth.authorizers=["ldapauth"] druid.auth.authorizer.ldapauth.type=basic druid.auth.authorizer.ldapauth.initialAdminUser=druid-bind@domain.com druid.auth.authorizer.ldapauth.initialAdminRole=Admin druid.auth.authorizer.ldapauth.roleProvider.type=ldap This is my Basic Auth # Druid basic security druid.auth.authorizers=["MyBasicPostgreSQLAuthorizer"] druid.auth.authorizer.MyBasicPostgreSQLAuthorizer.type=basic druid.auth.authenticatorChain=["MyBasicPostgreSQLAuthenticator"] druid.auth.authenticator.MyBasicPostgreSQLAuthenticator.type=basic druid.auth.authenticator.MyBasicPostgreSQLAuthenticator.initialAdminPassword=Admin druid.auth.authenticator.MyBasicPostgreSQLAuthenticator.initialInternalClientPassword=Client druid.auth.authenticator.MyBasicPostgreSQLAuthenticator.credentialsValidator.type=metadata druid.auth.authenticator.MyBasicPostgreSQLAuthenticator.skipOnFailure=false druid.auth.authenticator.MyBasicPostgreSQLAuthenticator.authorizerName=MyBasicPostgreSQLAuthorizer # Escalator druid.escalator.type=basic druid.escalator.internalClientUsername=druid_system druid.escalator.internalClientPassword=Client druid.escalator.authorizerName=MyBasicPostgreSQLAuthorizer
s
just making sure that wherever we see "<domain>" or "domain.com" you've just changed this to show us, that isn't actually the config value, right?
s
yeah, i just changed it to show hear, was using my company one there
@Sergio Ferragut did u get a choice to check
s
Still researching. @Tejas Parbat what did you mean by "add the LDAP user to Druid" ?
t
Hi @Satish N If you are using Active directory you may need to keep the 
druid.auth.authenticator.ldap.credentialsValidator.userSearch=(&(sAMAccountName=%s)(objectClass=user))
instead of 
druid.auth.authenticator.ldap.credentialsValidator.userSearch=(sAMAccountName=druid-bind)
✔️ 1
druid.escalator.internalClientUsername
need to be the user name used for the AD attribute 
druid.auth.authenticator.ldap.credentialsValidator.userAttribute
if its sAMAccountName most likely it will be username with out 
@domain
. You could verify this by firing a ldapsearch command 
<https://druid.apache.org/docs/latest/operations/auth-ldap.html#test-your-ldap-search>
What ever user which ldapsearch satisfies should be the username used in escalator also 
druid.escalator.internalClientUsername
druid.auth.authenticator.ldap.credentialsValidator.userSearch=(sAMAccountName=druid-bind)
is not correct . This searches ldap with the hardcoded 
druid-bind
user which not what we want to search.
s
@Tijo Thomas Can you pl let me know When you available for quick chat, did the changes but still getting the error
t
@Satish N can you please confirm theLDAP connectivity with below command once add a values as per your env
Copy code
ldapsearch -x -W -H <ldap://ip_address:389>  -D "<mailto:druid-bind@domain.com|druid-bind@domain.com>" -b "dc=domain,dc=com" "(sAMAccountName=myuser)"
s
The search works fine @Tijo Thomas
t
we will try with only LDAP configs as per https://druid.apache.org/docs/latest/operations/auth-ldap.html. currenlty LDAP config is enabled or basic metadata auth also enabled ?
Copy code
druid.auth.authenticatorChain=["ldap"]
druid.auth.authenticator.ldap.type=basic
druid.auth.authenticator.ldap.enableCacheNotifications=true
druid.auth.authenticator.ldap.credentialsValidator.type=ldap
druid.auth.authenticator.ldap.credentialsValidator.url=<ldap://ip_address>:port
druid.auth.authenticator.ldap.credentialsValidator.bindUser=administrator@example.com
druid.auth.authenticator.ldap.credentialsValidator.bindPassword=adminpassword
druid.auth.authenticator.ldap.credentialsValidator.baseDn=dc=example,dc=com
druid.auth.authenticator.ldap.credentialsValidator.userSearch=(&(sAMAccountName=%s)(objectClass=user))
druid.auth.authenticator.ldap.credentialsValidator.userAttribute=sAMAccountName
druid.auth.authenticator.ldap.authorizerName=ldapauth
druid.escalator.type=basic
druid.escalator.internalClientUsername=internal@example.com
druid.escalator.internalClientPassword=internaluserpassword
druid.escalator.authorizerName=ldapauth
druid.auth.authorizers=["ldapauth"]
druid.auth.authorizer.ldapauth.type=basic
druid.auth.authorizer.ldapauth.initialAdminUser=internal@example.com
druid.auth.authorizer.ldapauth.initialAdminRole=admin
druid.auth.authorizer.ldapauth.roleProvider.type=ldap
in common runtime pls add only LDAP related properties as above
s
Currently both r enabled as the group creation was giving error with ldap enabled.
sure
t
can you please hash other properties except above
we need one authentictor , authzizer and escalator as pasted above
s
administrator and internal user can be same right
t
yeah but it would be great if you can use diff users
bind user is specially used to bind your app with LDAP
s
As per document as we using the same user skipping 4 and 5 and when we create the group getting the error
t
if both are same and can skip 4 and 5 and follow next druid.escalator.internalClientUsername=internal@example.com druid.auth.authorizer.ldapauth.initialAdminUser=internal@example.com
s
When i am creating the role getting the getting group mapping errors
HTTP/1.1 500 Server Error HTTP/1.1 500 Server Error < Cache-Control: must-revalidate,no-cache,no-store Cache-Control: must-revalidate,no-cache,no-store < Content-Type: text/html;charset=iso-8859-1 Content-Type: text/html;charset=iso-8859-1 < Content-Length: 7924 Content-Length: 7924 < Connection: close Connection: close < <html> <head> <meta http-equiv="Content-Type" content="text/html;charset=utf-8"/> <title>Error 500 java.lang.RuntimeException: Configuration problem - Invalid groupMapping &apos;GG_Teradata_Linux_Admins&apos;</title> </head> <body><h2>HTTP ERROR 500 java.lang.RuntimeException: Configuration problem - Invalid groupMapping &apos;GG_Teradata_Linux_Admins&apos;</h2> <table> <tr><th>URI:</th><td>/druid-ext/basic-security/authorization/db/ldapauth/roles/readRole1</td></tr> <tr><th>STATUS:</th><td>500</td></tr> <tr><th>MESSAGE&lt;/th&gt;&lt;td&gt;java.lang.RuntimeException Configuration problem - Invalid groupMapping &apos;GG_Teradata_Linux_Admins&apos;</td></tr> <tr><th>SERVLET:</th><td>default</td></tr> <tr><th>CAUSED BY&lt;/th&gt;&lt;td&gt;java.lang.RuntimeException Configuration problem - Invalid groupMapping &apos;GG_Teradata_Linux_Admins&apos;</td></tr> </table> <h3>Caused by&lt;/h3&gt;&lt;pre&gt;java.lang.RuntimeException Configuration problem - Invalid groupMapping &apos;GG_Teradata_Linux_Admins&apos; at org.apache.druid.security.basic.authorization.LDAPRoleProvider.getRoles(LDAPRoleProvider.java:157)
t
is services running fine ?
<tr><th>CAUSED BY&lt;/th&gt;&lt;td&gt;java.lang.RuntimeException Configuration problem - Invalid groupMapping &apos;GG_Teradata_Linux_Admins&apos;</td></tr>
pls check if json is correct
s
yes the services are running fine
t
are you able to create role
Copy code
curl -i -v  -H "Content-Type: application/json" -u internal -X POST  <http://localhost:8081/druid-ext/basic-security/authorization/db/ldapauth/roles/readRole>
s
no, while creating the role only getting the above error. hear is the full error
curl -i -v -H "Content-Type: application/json" -u druid-bind -X POST http://localhost:8081/druid-ext/basic-security/authorization/db/ldapauth/roles/readRole1 Enter host password for user 'druid-bind': * About to connect() to localhost port 8081 (#0) * Trying 127.0.0.1... * Connected to localhost (127.0.0.1) port 8081 (#0) * Server auth using Basic with user 'druid-bind'
POST /druid-ext/basic-security/authorization/db/ldapauth/roles/readRole1 HTTP/1.1
Authorization: Basic ZHJ1aWQtYmluZDpMOW5AaiQ3QXIjMEY1bEI=
User-Agent: curl/7.29.0
Host: localhost:8081
Accept: /
Content-Type: application/json
< HTTP/1.1 500 Server Error HTTP/1.1 500 Server Error < Cache-Control: must-revalidate,no-cache,no-store Cache-Control: must-revalidate,no-cache,no-store < Content-Type: text/html;charset=iso-8859-1 Content-Type: text/html;charset=iso-8859-1 < Content-Length: 7924 Content-Length: 7924 < Connection: close Connection: close < <html> <head> <meta http-equiv="Content-Type" content="text/html;charset=utf-8"/> <title>Error 500 java.lang.RuntimeException: Configuration problem - Invalid groupMapping &apos;GG_Teradata_Linux_Admins&apos;</title> </head> <body><h2>HTTP ERROR 500 java.lang.RuntimeException: Configuration problem - Invalid groupMapping &apos;GG_Teradata_Linux_Admins&apos;</h2> <table> <tr><th>URI:</th><td>/druid-ext/basic-security/authorization/db/ldapauth/roles/readRole1</td></tr> <tr><th>STATUS:</th><td>500</td></tr> <tr><th>MESSAGE&lt;/th&gt;&lt;td&gt;java.lang.RuntimeException Configuration problem - Invalid groupMapping &apos;GG_Teradata_Linux_Admins&apos;</td></tr> <tr><th>SERVLET:</th><td>default</td></tr> <tr><th>CAUSED BY&lt;/th&gt;&lt;td&gt;java.lang.RuntimeException Configuration problem - Invalid groupMapping &apos;GG_Teradata_Linux_Admins&apos;</td></tr> </table> <h3>Caused by&lt;/h3&gt;&lt;pre&gt;java.lang.RuntimeException Configuration problem - Invalid groupMapping &apos;GG_Teradata_Linux_Admins&apos; at org.apache.druid.security.basic.authorization.LDAPRoleProvider.getRoles(LDAPRoleProvider.java:157) at org.apache.druid.security.basic.authorization.LDAPRoleProvider.getRoles(LDAPRoleProvider.java:101) at org.apache.druid.security.basic.authorization.BasicRoleBasedAuthorizer.authorize(BasicRoleBasedAuthorizer.java:88) at org.apache.druid.server.security.AuthorizationUtils.authorizeAllResourceActions(AuthorizationUtils.java:121) at org.apache.druid.server.security.AuthorizationUtils.authorizeAllResourceActions(AuthorizationUtils.java:167) at org.apache.druid.server.security.AuthorizationUtils.authorizeResourceAction(AuthorizationUtils.java:61) at org.apache.druid.security.basic.BasicSecurityResourceFilter.filter(BasicSecurityResourceFilter.java:56) at com.sun.jersey.server.impl.uri.rules.HttpMethodRule.accept(HttpMethodRule.java:281) at com.sun.jersey.server.impl.uri.rules.RightHandPathRule.accept(RightHandPathRule.java:147) at com.sun.jersey.server.impl.uri.rules.ResourceClassRule.accept(ResourceClassRule.java:108) at com.sun.jersey.server.impl.uri.rules.RightHandPathRule.accept(RightHandPathRule.java:147) at com.sun.jersey.server.impl.uri.rules.RootResourceClassesRule.accept(RootResourceClassesRule.java:84) at com.sun.jersey.server.impl.application.WebApplicationImpl._handleRequest(WebApplicationImpl.java:1542) at com.sun.jersey.server.impl.application.WebApplicationImpl._handleRequest(WebApplicationImpl.java:1473) at com.sun.jersey.server.impl.application.WebApplicationImpl.handleRequest(WebApplicationImpl.java:1419) at com.sun.jersey.server.impl.application.WebApplicationImpl.handleRequest(WebApplicationImpl.java:1409) at com.sun.jersey.spi.container.servlet.WebComponent.service(WebComponent.java:409) at com.sun.jersey.spi.container.servlet.ServletContainer.service(ServletContainer.java:558) at com.sun.jersey.spi.container.servlet.ServletContainer.service(ServletContainer.java:733) at javax.servlet.http.HttpServlet.service(HttpServlet.java:790) at com.google.inject.servlet.ServletDefinition.doServiceImpl(ServletDefinition.java:286) at com.google.inject.servlet.ServletDefinition.doService(ServletDefinition.java:276) at com.google.inject.servlet.ServletDefinition.service(ServletDefinition.java:181) at com.google.inject.servlet.ManagedServletPipeline.service(ManagedServletPipeline.java:91) at com.google.inject.servlet.ManagedFilterPipeline.dispatch(ManagedFilterPipeline.java:120) at com.google.inject.servlet.GuiceFilter.doFilter(GuiceFilter.java:135) at org.eclipse.jetty.servlet.FilterHolder.doFilter(FilterHolder.java:193) at org.eclipse.jetty.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1601) at org.apache.druid.server.http.RedirectFilter.doFilter(RedirectFilter.java:73) at org.eclipse.jetty.servlet.FilterHolder.doFilter(FilterHolder.java:193) at org.eclipse.jetty.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1601) at org.apache.druid.server.security.PreResponseAuthorizationCheckFilter.doFilter(PreResponseAuthorizationCheckFilter.java:82) at org.eclipse.jetty.servlet.FilterHolder.doFilter(FilterHolder.java:193) at org.eclipse.jetty.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1601) at org.apache.druid.server.security.AllowHttpMethodsResourceFilter.doFilter(AllowHttpMethodsResourceFilter.java:78) at org.eclipse.jetty.servlet.FilterHolder.doFilter(FilterHolder.java:193) at org.eclipse.jetty.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1601) at org.apache.druid.server.security.AllowOptionsResourceFilter.doFilter(AllowOptionsResourceFilter.java:75) at org.eclipse.jetty.servlet.FilterHolder.doFilter(FilterHolder.java:193) at org.eclipse.jetty.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1601) at org.apache.druid.security.basic.authentication.BasicHTTPAuthenticator$BasicHTTPAuthenticationFilter.doFilter(BasicHTTPAuthenticator.java:208) at org.apache.druid.server.security.AuthenticationWrappingFilter.doFilter(AuthenticationWrappingFilter.java:59) at org.eclipse.jetty.servlet.FilterHolder.doFilter(FilterHolder.java:193) at org.eclipse.jetty.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1601) at org.apache.druid.server.security.SecuritySanityCheckFilter.doFilter(SecuritySanityCheckFilter.java:77) at org.eclipse.jetty.servlet.FilterHolder.doFilter(FilterHolder.java:193) at org.eclipse.jetty.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1601) at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:548) at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:233) at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:1624) at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:233) at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1435) at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:188) at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:501) at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:1594) at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:186) at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1350) at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:141) at org.eclipse.jetty.server.handler.gzip.GzipHandler.handle(GzipHandler.java:763) at org.eclipse.jetty.server.handler.HandlerList.handle(HandlerList.java:59) at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:127) at org.eclipse.jetty.server.Server.handle(Server.java:516) at org.eclipse.jetty.server.HttpChannel.lambda$handle$1(HttpChannel.java:388) at org.eclipse.jetty.server.HttpChannel.dispatch(HttpChannel.java:633) at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:380) at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:277) at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:311) at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:105) at org.eclipse.jetty.io.ChannelEndPoint$1.run(ChannelEndPoint.java:104) at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.runTask(EatWhatYouKill.java:336) at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.doProduce(EatWhatYouKill.java:313) at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.tryProduce(EatWhatYouKill.java:171) at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.run(EatWhatYouKill.java:129) at org.eclipse.jetty.util.thread.ReservedThreadExecutor$ReservedThread.run(ReservedThreadExecutor.java:383) at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:882) at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThreadPool.java:1036) at java.lang.Thread.run(Thread.java:748) </pre> </body> </html>
t
is intial admin user and bind user is same?
s
yes in the config
have a min for quick call?
t
it seems even creating new role is giving below error @Tijo Thomas pls suggest if anything . also the druid -bind user and group belongs to diff OU's might need to check if bind user has control over OU where group belongs to.
Copy code
<tr><th>CAUSED BY:</th><td>java.lang.RuntimeException: Configuration problem - Invalid groupMapping &apos;GG_Teradata_Linux_Admins&apos;</td></tr>
pls try on quickstart with same configs for test
t
@Satish N , Can you show the sAMAccountName entry how it appear in ldapsearch for internal user . is it appear as 
<mailto:internal@example.com|internal@example.com>
. I hope its just 
internal
. In that case u need to use the same in the config not 
<mailto:internal@example.com|internal@example.com>
t
they are using druid-bind@domain.com as initial admin as well as bind user
t
i think that is the reason for the error. I feel its worth for a clean start . remove use from metadata store and start again .
✔️ 1
s
@Tijo Thomas i can do that but before starting wanted to make sure do i give druid-bind@domain.com or just druid-bind as the document shows use the domain.com.
@Tejas Parbat & @Tijo Thomas i wiped out all and recreated the cluser with below entrires. druid.auth.authenticatorChain=["ldap"] druid.auth.authenticator.ldap.type=basic druid.auth.authenticator.ldap.enableCacheNotifications=true druid.auth.authenticator.ldap.credentialsValidator.type=ldap druid.auth.authenticator.ldap.credentialsValidator.url=ldap//&lt;ad.address&gt;389 druid.auth.authenticator.ldap.credentialsValidator.bindUser=druid-bind druid.auth.authenticator.ldap.credentialsValidator.bindPassword=<password> druid.auth.authenticator.ldap.credentialsValidator.baseDn=dc=<domain>,dc=com druid.auth.authenticator.ldap.credentialsValidator.userSearch=(&(sAMAccountName=%s)(objectClass=user)) druid.auth.authenticator.ldap.credentialsValidator.userAttribute=sAMAccountName druid.auth.authenticator.ldap.authorizerName=ldapauth druid.escalator.type=basic druid.escalator.internalClientUsername=druid-bind druid.escalator.internalClientPassword=<password> druid.escalator.authorizerName=ldapauth druid.auth.authorizers=["ldapauth"] druid.auth.authorizer.ldapauth.type=basic druid.auth.authorizer.ldapauth.initialAdminUser=druid-bind druid.auth.authorizer.ldapauth.initialAdminRole=admin druid.auth.authorizer.ldapauth.roleProvider.type=ldap
When logged with druid-bind id i see the below screen
--Also when i create the role haven't seen error but i am seeing the same screen for both display also [druid@lxappdruprdw127 ~]$ curl -i -v -H "Content-Type: application/json" -u druid-bind -X POST http://localhost:8081/druid-ext/basic-security/authorization/db/ldapauth/roles/readRole6 Enter host password for user 'druid-bind': * About to connect() to localhost port 8081 (#0) * Trying 127.0.0.1... * Connected to localhost (127.0.0.1) port 8081 (#0) * Server auth using Basic with user 'druid-bind'
POST /druid-ext/basic-security/authorization/db/ldapauth/roles/readRole6 HTTP/1.1
Authorization: Basic ZHJ1aWQtYmluZDpMOW5AaiQ3QXIjMEY1bEI=
User-Agent: curl/7.29.0
Host: localhost:8081
Accept: /
Content-Type: application/json
< HTTP/1.1 200 OK HTTP/1.1 200 OK < Date: Wed, 01 Feb 2023 034113 GMT Date: Wed, 01 Feb 2023 034113 GMT < Content-Type: application/json Content-Type: application/json < Vary: Accept-Encoding, User-Agent Vary: Accept-Encoding, User-Agent < Content-Length: 0 Content-Length: 0 < * Connection #0 to host localhost left intact [druid@lxappdruprdw127 ~]$ curl -i -v -H "Content-Type: application/json" -u druid-bind -X GET http://localhost:8081/druid-ext/basic-security/authorization/db/ldapauth/roles Enter host password for user 'druid-bind': * About to connect() to localhost port 8081 (#0) * Trying 127.0.0.1... * Connected to localhost (127.0.0.1) port 8081 (#0) * Server auth using Basic with user 'druid-bind'
GET /druid-ext/basic-security/authorization/db/ldapauth/roles HTTP/1.1
Authorization: Basic ZHJ1aWQtYmluZDpMOW5AaiQ3QXIjMEY1bEI=
User-Agent: curl/7.29.0
Host: localhost:8081
Accept: /
Content-Type: application/json
< HTTP/1.1 200 OK HTTP/1.1 200 OK < Date: Wed, 01 Feb 2023 034216 GMT Date: Wed, 01 Feb 2023 034216 GMT < Content-Type: application/json Content-Type: application/json < Vary: Accept-Encoding, User-Agent Vary: Accept-Encoding, User-Agent < Transfer-Encoding: chunked Transfer-Encoding: chunked < * Connection #0 to host localhost left intact
t
can you please follow rest steps as well. https://druid.apache.org/docs/latest/operations/auth-ldap.html
assigning permissions to role and attach role to group mapping
@Satish N here are some basic security examples and same way you can use with LDAP endpoints as per https://druid.apache.org/docs/latest/operations/auth-ldap.html Managing Users Listing users Check for current users to be authenticated using basic security:
Copy code
curl -XGET -H'Content-Type: application/json' -uadmin:Pass_From_APISection -k <https://localhost:8281/druid-ext/basic-security/authentication/db/basic/users>

["admin","John"]
Create user Create users needed using an API similar to the following:
Copy code
curl -XPOST -H'Content-Type: application/json' -uadmin:Pass_From_APISection -k <https://localhost:8281/druid-ext/basic-security/authentication/db/basic/users/john>
Set user password
Copy code
curl -XPOST -H'Content-Type: application/json' -d @password.json -uadmin:Pass_From_APISection -k <https://localhost:8281/druid-ext/basic-security/authentication/db/{authenticatorName}/users/john/credentials>
password.json: { "password": "Imply-123" } Delete user
Copy code
curl -XDELETE -H'Content-Type: application/json' -uadmin:Pass_From_APISection -k <https://localhost:8281/druid-ext/basic-security/authentication/db/basic/users/john>
Describe user Short Authentication Description
Copy code
curl -XGET -H'Content-Type: application/json' -uadmin:Pass_From_APISection -k <https://localhost:8281/druid-ext/basic-security/authentication/db/basic/users/admin>

{"name":"admin","credentials":{"salt":"aUYFxrSb1PuyklsI/WUg629HxOi73cbl7vrehzZ13Ik=","hash":"3la9loHU1NgEcJHiUcp6BzqcXvhqZxspMegYy/93xawZhxalJYmN2aHbjhs6u4zGggo0+typaBqex89Nmo7Vcw==","iterations":10000}}
Short Authorization Description
Copy code
curl -XGET -H'Content-Type: application/json' -uadmin:Pass_From_APISection -k <https://localhost:8281/druid-ext/basic-security/authorization/db/basic/users/admin>

{"name":"admin","roles":["admin"]}
Full Authorization Description
Copy code
curl -XGET -H'Content-Type: application/json' -uadmin:Pass_From_APISection -k <https://localhost:8281/druid-ext/basic-security/authorization/db/basic/users/admin?full>

{

"name": "admin",

"roles": [{

"name": "admin",

"permissions": [{

"resourceAction": {

"resource": {

"name": ".*",

"type": "DATASOURCE"

},

"action": "READ"

},

"resourceNamePattern": ".*"

}, {

"resourceAction": {

"resource": {

"name": ".*",

"type": "DATASOURCE"

},

"action": "WRITE"

},

"resourceNamePattern": ".*"

}, {

"resourceAction": {

"resource": {

"name": ".*",

"type": "CONFIG"

},

"action": "READ"

},

"resourceNamePattern": ".*"

}, {

"resourceAction": {

"resource": {

"name": ".*",

"type": "CONFIG"

},

"action": "WRITE"

},

"resourceNamePattern": ".*"

}, {

"resourceAction": {

"resource": {

"name": ".*",

"type": "STATE"

},

"action": "READ"

},

"resourceNamePattern": ".*"

}, {

"resourceAction": {

"resource": {

"name": ".*",

"type": "STATE"

},

"action": "WRITE"

},

"resourceNamePattern": ".*"

}]

}]

}
Roles List roles
Copy code
curl -XGET -H'Content-Type: application/json' -uadmin:Pass_From_APISection -k <https://localhost:8281/druid-ext/basic-security/authorization/db/basic/roles/>

["admin","druid_system","dataGrip"]
Create Role
Copy code
curl -XPOST -H'Content-Type: application/json'  -uadmin:Pass_From_APISection -k <https://localhost:8281/druid-ext/basic-security/authorization/db/basic/roles/dataGrip>
curl -XGET -H'Content-Type: application/json'  -uadmin:Pass_From_APISection -k <https://localhost:8281/druid-ext/basic-security/authorization/db/basic/roles>

["admin","druid_system","dataGrip"]
Assign Permissions to role
Copy code
curl -XPOST -H'Content-Type: application/json' -d @role_permissions.json -uadmin:Pass_From_APISection -k <https://localhost:8281/druid-ext/basic-security/authorization/db/basic/roles/dataGrip/permissions>
role_permission.json:
Copy code
[

{

  "resource": {

    "name": "wiki.*",

    "type": "DATASOURCE"

  },

  "action": "READ"

},

{

  "resource": {

    "name": "wikiticker",

    "type": "DATASOURCE"

  },

  "action": "WRITE"

}

]
Modify Role Permissions Get the current Role Permissions
Copy code
curl -XGET -H'Content-Type: application/json' -uadmin:Pass_From_APISection -k <https://localhost:8281/druid-ext/basic-security/authorization/db/basic/roles/dataGrip/permissions>

[{

"resourceAction": {

"resource": {

"name": "wiki.*",

"type": "DATASOURCE"

},

"action": "READ"

},

"resourceNamePattern": "wiki.*"

}, {

"resourceAction": {

"resource": {

"name": "wikiticker",

"type": "DATASOURCE"

},

"action": "WRITE"

},

"resourceNamePattern": "wikiticker"

}]
Currently, user jonh with dataGrip role would be able to only read / write datasources with names starting with wiki.. Trying to access datasources with name druidKafka would fail with the following error: [00000][-1] Error -1 (00000) : Error while executing SQL "select * from druid.druidKafka1": Remote driver error: RuntimeException: org.apache.druid.server.security.ForbiddenException: Allowed:false, Message: -> ForbiddenException: Allowed:false, Message: To give permission to datasources by name druidKafka*, role_permissions.json role_permissions.json file needs to be modified. Copy the above to a file and amend/add permissions. For example, create a file called role_permission.json:
Copy code
[

{

  "resource": {

    "name": "druid.*",

    "type": "DATASOURCE"

  },

  "action": "READ"

},

{

  "resource": {

    "name": "druidKafka.*",

    "type": "DATASOURCE"

  },

  "action": "WRITE"

}

]
NOTE: resourcePatternName is removed from the Json while saving. Run the following command to change the permissions for dataGrip role using the above json file:
Copy code
curl -XPOST -H'Content-Type: application/json' -d @role_permission.json -uadmin:Pass_From_APISection -k <https://localhost:8281/druid-ext/basic-security/authorization/db/basic/roles/dataGrip>
Check the role Permissions
Copy code
curl -XGET -H'Content-Type: application/json' -uadmin:Pass_From_APISection -k <https://localhost:8281/druid-ext/basic-security/authorization/db/basic/roles/dataGrip/permissions>

[{"resourceAction":{"resource":{"name":"druid.*","type":"DATASOURCE"},"action":"READ"},"resourceNamePattern":"druid.*"},{"resourceAction":{"resource":{"name":"druidKafka.*","type":"DATASOURCE"},"action":"WRITE"},"resourceNamePattern":"druidKafka.*"}]
Try to access the tables as user john now. Accessing druidKafka1: [00000][-1] Error -1 (00000) : Error while executing SQL "select count(*) from *druidKafka1*": Remote driver error: RuntimeException: org.apache.druid.server.security.ForbiddenException: Allowed:false, Message: -> ForbiddenException: Allowed:false, Message: Accessing druidKinesis1: select count(*) from druidKinesis1 7743372 Query successfully completed. Delete Role
Copy code
curl -XDELETE -H'Content-Type: application/json' -uadmin:Pass_From_APISection -k <https://localhost:8281/druid-ext/basic-security/authorization/db/basic/roles/dataGrip>
List Roles after Deletion:
Copy code
curl -XGET -H'Content-Type: application/json' -uadmin:Pass_From_APISection -k <https://localhost:8281/druid-ext/basic-security/authorization/db/basic/roles/>

["admin","druid_system"]imply@ip-10-2-203-157:~$
Managing User with Roles List User Roles
Copy code
curl -XGET -H'Content-Type: application/json' -uadmin:Pass_From_APISection -k <https://localhost:8281/druid-ext/basic-security/authorization/db/basic/users/admin>

{"name":"admin","roles":["admin"]}
Associate user for Authorization Once a user is created using the commands above, it can be enabled for Authorization.
Copy code
curl -XPOST -H'Content-Type: application/json' -uadmin:Pass_From_APISection -k <https://localhost:8281/druid-ext/basic-security/authorization/db/basic/users/john>

{"error":"User [john] already exists."}
Assign Role to a User
Copy code
curl -XPOST -H'Content-Type: application/json' -uadmin:Pass_From_APISection -k <https://localhost:8281/druid-ext/basic-security/authorization/db/basic/users/john/roles/admin>
Remove Role from a user
Copy code
curl -XDELETE -H'Content-Type: application/json' -uadmin:Pass_From_APISection -k <https://localhost:8281/druid-ext/basic-security/authorization/db/basic/users/john/roles/admin>
i
@Michael Taranov might help you
2 Views
Open in Slack
PreviousNext
Powered by