This message was deleted.
# troubleshootings
Slackbot
03/07/2023, 5:28 PMThis message was deleted.
g
Gian Merlino
03/07/2023, 6:56 PMthe escalator is important: it's how the servers authenticate to each other. so you should at least have a Druid metadata user for this
🙏 1
Gian Merlino
03/07/2023, 6:57 PMLDAP and Druid metadata users would be separate authenticators, but you can use the same authorizer for both if you like. the authorizer you define would need to be able to handle identities from both authenticators
d
Didip Kerabat
03/07/2023, 7:31 PMWhen you talked about metadata users, what do you mean by this?
g
Gian Merlino
03/07/2023, 9:09 PMI assumed it meant users whose authentication info (username / hashed pass) are stored in Druid's metadata store
đź‘Ť 2
Gian Merlino
03/07/2023, 9:09 PMi.e.
basicm
Michael Taranov
03/07/2023, 9:39 PM@Gian Merlino thanks for your replies.
About
“the authorizer you define would need to be able to handle identities from both authenticators”Is this may be done by configuration only or some additional implementation is needed?
d
Didip Kerabat
03/07/2023, 10:32 PMTIL: you can use the same authorizer for both. We always separate them out: basicAuth & LDAP.
@Michael Taranov authentication and authorization are all configured using the Coordinator Rest API.
Didip Kerabat
03/07/2023, 10:35 PMThe way we do it is by:
1. configured authentication & authorization for basicAuth.
2. configured authentication & authorization for LDAP.
3. And then configure an escalator by first checking the basicAuth and if missing check LDAP.
m
Michael Taranov
03/08/2023, 7:23 AMThanks for help @Didip Kerabat, will try
Michael Taranov
03/08/2023, 2:47 PMHi Again,
Tried to define following but still when starting quickstart I’m getting errors about internal user
druid_system Copy code
023-03-08T14:34:36,236 INFO [qtp456172878-137] org.apache.druid.security.basic.authentication.BasicHTTPAuthenticator - Exception authenticating user druid_system - Unauthorized
2023-03-08T14:34:36,474 INFO [qtp456172878-136] org.apache.druid.security.basic.authentication.BasicHTTPAuthenticator - Exception authenticating user druid_system - UnauthorizedMichael Taranov
03/08/2023, 3:20 PMOk I found that I can’t even Authz with basic settings without additional LDAP.
Might it be because of some users already stored in metadata in some way ?
Copy code
druid.auth.authenticatorChain=["MyBasicMetadataAuthenticator"]
druid.auth.authenticator.MyBasicMetadataAuthenticator.type=basic
druid.auth.authenticator.MyBasicMetadataAuthenticator.initialAdminPassword=password1 # admin user
druid.auth.authenticator.MyBasicMetadataAuthenticator.initialInternalClientPassword=password2 # druid_system user
druid.auth.authenticator.MyBasicMetadataAuthenticator.credentialsValidator.type=metadata
druid.auth.authenticator.MyBasicMetadataAuthenticator.skipOnFailure=true
druid.auth.authenticator.MyBasicMetadataAuthenticator.authorizerName=MyBasicMetadataAuthorizer
druid.escalator.type=basic
druid.escalator.internalClientUsername=druid_system
druid.escalator.internalClientPassword=password2
druid.escalator.authorizerName=MyBasicMetadataAuthorizer
druid.auth.authorizers=["MyBasicMetadataAuthorizer"]
druid.auth.authorizer.MyBasicMetadataAuthorizer.type=basic
druid.auth.authorizer.MyBasicMetadataAuthorizer.initialAdminUser=admin
druid.auth.authorizer.MyBasicMetadataAuthorizer.initialAdminRole=admin
druid.auth.authorizer.MyBasicMetadataAuthorizer.roleProvider.type=metadataMichael Taranov
03/08/2023, 4:19 PMAfter removing Derby DB again and first initializing basic auth and only then adding LDAP auth I succeed to work with both LDAP and metadata users.
These are final configurations in case it will help to someone.
d
Didip Kerabat
03/09/2023, 12:02 AMoh yes, the metadata DB must be a networked DB (PG/MySQL), and not embedded like Derby.
âś… 1
4 Views