You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@druid.apache.org by GitBox <gi...@apache.org> on 2022/12/06 09:51:33 UTC
[GitHub] [druid] wiegandf opened a new issue, #13507: Unauthorized call to /druid/indexer/v1/supervisor returns 200
wiegandf opened a new issue, #13507:
URL: https://github.com/apache/druid/issues/13507
### Affected Version
0.23.0
## Description
The get endpoint for `/druid/indexer/v1/supervisor` seems to require more than just read permissions. With missing those permissions, the API returns a 200 with an empty list. I would expect a 401 Unauthorized. When authorized, the API returns all the data required.
So basically I see two issues:
- The API should respond with 401 for unauthorized calls
- Why does the list supervisor operation require write permissions?
This behavior breaks e.g. https://github.com/opstree/druid-exporter/blob/master/collector/druid.go#L50-L67.
### Configurations in use
druid-basic-security
```
druid_auth_authenticatorChain: '["MyBasicMetadataAuthenticator"]'
druid_auth_authenticator_MyBasicMetadataAuthenticator_type: basic
druid_auth_authenticator_MyBasicMetadataAuthenticator_authorizerName: MyBasicMetadataAuthorizer
druid_auth_authorizers: '["MyBasicMetadataAuthorizer"]'
druid_auth_authorizer_MyBasicMetadataAuthorizer_type: basic
druid_escalator_type: basic
druid_escalator_internalClientUsername: druid_system
druid_escalator_authorizerName: MyBasicMetadataAuthorizer
```
### Steps to reproduce the problem
- Have one user with the following permissions:
```json
[
{
"resource": {
"name": ".*",
"type": "DATASOURCE"
},
"action": "WRITE"
},
{
"resource": {
"name": ".*",
"type": "CONFIG"
},
"action": "WRITE"
},
{
"resource": {
"name": ".*",
"type": "STATE"
},
"action": "WRITE"
},
{
"resource": {
"name": ".*",
"type": "DATASOURCE"
},
"action": "READ"
},
{
"resource": {
"name": ".*",
"type": "CONFIG"
},
"action": "READ"
},
{
"resource": {
"name": ".*",
"type": "STATE"
},
"action": "READ"
}
]
```
- Another one with just
```json
[
{
"resource": {
"name": ".*",
"type": "DATASOURCE"
},
"action": "READ"
},
{
"resource": {
"name": ".*",
"type": "CONFIG"
},
"action": "READ"
},
{
"resource": {
"name": ".*",
"type": "STATE"
},
"action": "READ"
}
]
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
[GitHub] [druid] kfaraz commented on issue #13507: Unauthorized call to /druid/indexer/v1/supervisor returns 200
Posted by GitBox <gi...@apache.org>.
kfaraz commented on issue #13507:
URL: https://github.com/apache/druid/issues/13507#issuecomment-1357107247
@wiegandf , that's correct, this is just a GET endpoint. So you are authorized to hit the API itself, but the result of the API is the list of supervisors to which you have WRITE access.
So you can always hit the API successfully, even if you don't have WRITE access to any supervisor. In that case, as you observed, you would get back an empty list. Hope that clarifies the confusion.
As for the docs,
> GET requests require READ permissions, while POST and DELETE requests require WRITE permissions.
This does hold true for the API in question as you are successfully able to hit the API even when you don't have WRITE permissions.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
[GitHub] [druid] wiegandf commented on issue #13507: Unauthorized call to /druid/indexer/v1/supervisor returns 200
Posted by GitBox <gi...@apache.org>.
wiegandf commented on issue #13507:
URL: https://github.com/apache/druid/issues/13507#issuecomment-1342543238
But the endpoint is just a get endpoint and doesn't ingest anything, right? So according to https://druid.apache.org/docs/latest/operations/security-user-auth.html#http-methods it should only require read permissions?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
[GitHub] [druid] abhishekagarwal87 commented on issue #13507: Unauthorized call to /druid/indexer/v1/supervisor returns 200
Posted by GitBox <gi...@apache.org>.
abhishekagarwal87 commented on issue #13507:
URL: https://github.com/apache/druid/issues/13507#issuecomment-1340645733
The supervisor is responsible for ingesting the data and that's why supervisor operations require write access. what operation are you referring to?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
Re: [I] Unauthorized call to /druid/indexer/v1/supervisor returns 200 (druid)
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on issue #13507:
URL: https://github.com/apache/druid/issues/13507#issuecomment-1890803977
This issue has been marked as stale due to 280 days of inactivity.
It will be closed in 4 weeks if no further activity occurs. If this issue is still
relevant, please simply write any comment. Even if closed, you can still revive the
issue at any time or discuss it on the dev@druid.apache.org list.
Thank you for your contributions.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
Re: [I] Unauthorized call to /druid/indexer/v1/supervisor returns 200 (druid)
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on issue #13507:
URL: https://github.com/apache/druid/issues/13507#issuecomment-1937927350
This issue has been closed due to lack of activity. If you think that
is incorrect, or the issue requires additional review, you can revive the issue at
any time.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
Re: [I] Unauthorized call to /druid/indexer/v1/supervisor returns 200 (druid)
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] closed issue #13507: Unauthorized call to /druid/indexer/v1/supervisor returns 200
URL: https://github.com/apache/druid/issues/13507
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org