This message was deleted.
# troubleshootings
Slackbot
03/08/2023, 7:06 PMThis message was deleted.
b
Ben Krug
03/08/2023, 8:21 PMI haven't tried, but I'd think you could use the escalator as a middle step, as you said. Eg something like druid.auth.authenticatorChain=[“BasicAuthenticator”, “anonymous”] or ["BasicAuthenticator","allowAll"], then once it's rolled out, do a second pass and remove the anonymous or allowAll. (But I haven't tried it.)
✅ 1
m
Michael Taranov
03/09/2023, 7:07 AMThanks for the tip.
b
Ben Krug
03/09/2023, 7:28 PMyw, I'd be curious to hear whether it works, and how it goes
g
Gian Merlino
03/10/2023, 2:09 AMyeah, i would do what ben suggested: include
allowAllallowAllGian Merlino
03/10/2023, 2:09 AMonce everyone is authenticating successfully then you can remove
allowAllm
Michael Taranov
03/12/2023, 11:27 AMSo my auth chain looks like following
Copy code
druid.auth.authenticatorChain=["metadata-auth", "ldap", "anonymous"],
druid.auth.authenticator.anonymous.type=anonymous
druid.auth.authenticator.anonymous.identity=defaultUser
druid.auth.authenticator.anonymous.authorizerName=allowAll
druid.auth.authorizers=["metadata-authz", "ldapauth", "allowAll"]
druid.auth.authorizer.allowAll.type=allowAll Copy code
druid.escalator.type=noop
druid.escalator.authorizerName=allowAll Copy code
druid.auth.authorizer.allowAll.type=allowAllMichael Taranov
03/12/2023, 11:29 AMVerified with these settings that if people connect, for example, with LDAP they indeed logged with ldap identity in request.logging.
Michael Taranov
03/12/2023, 12:10 PMIt would be nice to hear more opinions over my configuration as, imo, these allowAll/anonymous configs are not documented properly
g
Gian Merlino
03/13/2023, 9:09 PMwhat's the issue with the documentation? we should be able to fix it
m
Michael Taranov
03/14/2023, 8:30 AM@Gian Merlino
This part was confusing …
I wasn’t able just to add
allowAlldruid.auth.authorizersdruid.auth.authorizer.allowAll.type=allowAllg
Gian Merlino
03/15/2023, 2:25 AMah, i see, probably an example would help…
Gian Merlino
03/15/2023, 2:25 AMdefinitely that page could use more examples
b
Ben Krug
03/17/2023, 11:37 PMOur docs team is looking in to it, thank you!
🙌 1
m
Michael Taranov
03/20/2023, 2:54 PMJust something worth to mention, the first service to restart while Auth update should be coordinator.
Initially started from historicals (as version upgrade suggest) , but got following exception and service failed to start.
Copy code
WARN [main] org.apache.druid.security.basic.authorization.db.cache.CoordinatorPollingBasicAuthorizerCacheManager - cachedSerializedGroupMappingMap is not available from the coordinator, skipping fetch of group mappings for now.Michael Taranov
03/22/2023, 6:38 AMSo the testing on Staging finished.
As @Ben Krug suggested initially, added anonymous/allowAll in the end of chain, when applied other auth methods, verified that they are working and I see correct identity in request logging.
Then created all relevant users/permissions/roles, removed anonymous/allowAll from the Auth/Authz chain and performed rolling restart.
Our order was Coordinators/Routers/Brokers/middleManagers/Historicals.
Not sure the order is correct after Coordinator but it worked without downtime and with minimal errors in log 🙂
Michael Taranov
03/22/2023, 6:38 AMThanks you all again
🎉 1
b
Ben Krug
03/24/2023, 1:57 PMThanks for the update!
14 Views