druid extension for OpenID Connect auth using pac4j lib #8992
Conversation
himanshug
force-pushed
the
pac4j_master
branch
from
10c9c60
to
111d474
Compare
|
@soumyajose0784 that sounds like that the ssl cert returned from server configured in |
|
yes, I am able to visit the the url in browser successfully. I have a trust-store created as well in linux machine with same certificate. But how do we specify the truststore parameter in common.runtime.properties. For eg, for ldap auth, we used to give the truststore path for ldap server as follows |
|
@soumyajose0784 as a workaround, can you try adding following properties in jvm args of Druid process ... and see if that works |
|
Thank you @himanshug that should be helpful we will try these setting and let you know. Do we need to pass the above java param to all the run time properties file or any specific node. |
they wouldn't go in runtime.properties file but must be added as jvm args to druid process , they should be added to only router node presuming that is one web console which admins would visit. |
|
@soumyajose0784 @averma111 also please add this commit ( #9627 ) to your 0.18.0 custom build. |
|
Thanks @himanshug for all the help and support.We will rebuild 0.18 again, I have also raised on more issue #9628. |
|
@averma111 can you remove the kerberos authenticator and let us try to make this auth working first , then we could add kerberos back in so that you have one set of problems at a time. |
|
@himanshug I am working on two druid instance simultaneously/separately , I have a tight deadline and need to provide solution for SSO by either way. hence exploring all the possible options. |
|
@averma111 @soumyajose0784 can you add the commit from https://github.com/apache/druid/pull/9637/files in your build then you should be able to specify custom ssl trustStore via following configuration in runtime.properties file... |
|
Sure, we will rebuild again and follow the instructions. |
|
@himanshug do we have any redirect url setting for Druid SSO, they wanted to know if we have any.They need for authorization code flow. |
|
yes in the auth server side you would need to add something like |
|
@himanshug my team is asking what we want to return such as user id, email address, roles, etc. what should we provide ? |
|
pac4j asks for |
|
@himanshug thank you |
|
I could bring up Druid services after making the changes highlighted above and its able to hit the ping federate url, but now its giving SSL error accessing the callback url https://:/druid-ext/druid-pac4j/callback. Could you please advise how can this be fixed?Our Druid endpoints are ssl enabled. Properties set are as follows Error details HTTP ERROR 500 |
|
@soumyajose0784 @averma111 thanks for trying. sorry to hear that, I am looking into it. unfortunately, I have access to 2 okta servers and both have standard ssl certs so custom truststore handling is being a bit difficult for me to verify fully. I think the problem is because pac4j lib is not using single mechanism to make HTTP requests as older issue reported in #8992 (comment) is not the problem anymore. I will make some change soon and would ask you to test it. I will get that PR merged only after your confirmation of everything working. |
|
@himanshug thank you for the taking this activity. Let us know when we can rebuild package again and test it. |
|
@averma111 @soumyajose0784 can you please get the commit from #9695 to your build and try ? |
|
@himanshug , we have built the commit from https://github.com/himanshug/druid/tree/pac4j_ssl, org.apache.druid.server.router.CoordinatorRuleManager - Exception while polling for rules Unknown exception / Unexpected response status [302] description [Found] from request url[https://:/druid/coordinator/v1/metadata/segments?includeOvershadowedStatus] / org.apache.druid.java.util.common.RE / on host |
|
@soumyajose0784 did you enable pac4j auth on non-router nodes as well? One option would be to not have pac4j auth on non-router nodes. However if you added pac4j on those nodes to be able to have SSO on the web console at coordinator/overlord, then following information is relevant. Router periodically talks to various other Druid nodes to gather some data that it displays. However, Router needs to be able to authenticate with those nodes to be able to talk to them successfully. That particular auth mechanism is enabled via configuring "Escalator", you can read about generic Druid auth stuff in https://druid.apache.org/docs/latest/design/auth.html#escalator . |
|
@himanshug , thank you for the great support. We are able to bring up the services (pac4j+basic auth enabled), and router console is now accessible with proper connection to other nodes |
|
glad that it worked out, thanks for testing. |
|
@himanshug, I want to setup router node with both basic authentication (for REST API access through python) and pac4j (browser access) and non-router nodes with basic authentication. Could you help me with the sample runtime.properties to achieve this kind of setup? I have tried what you had suggested (enable pac4j for router console and disable authentication at non-router nodes) and that setup works fine for browser based access. But I want to expose router and other nodes REST APIs for some automations. Thanks |
|
@shashisingh you can have something like below and that should work... also please read the docs in https://druid.apache.org/docs/latest/development/extensions-core/druid-basic-security.html |
|
@himanshug For configuring authorizations using the For example, my OIDC provider returns something like the following profile: I can create a druid basic user with name What I would like to do is create the druid basic user using another attribute such as Another option, even preferred, is to use |
Fixes #8984
Description
Druid security extension to support authentication based on OpenID Connect spec. Please see added file
druid-pac4j.mdfor further information.This patch...
Authenticatorimplementation using pac4j library/unified-console.htmlfrom default unsecured paths , and introducesUnautorizedResourceFiltersimilar to existingUnsecuredResourceFilterto avoid "authentication done" check made byPreResponseAuthorizationCheckFilter. This is done so that redirect to authentication server (e.g. Okta) is correctly handled by browser when user visits the web console.I have tested the it using Okta dev server . Also, a version of this code is running on our internal Druid clusters in prod with enterprise Okta auth server.
This PR has: