SSO support in Druid

[soumyajose0784]

Could anyone guide me on enabling SSO in Druid?
Please share the steps if available.

We have Druid single node implementation in GKE, and had successfully tested LDAP and Kerberos(with local KDC) authentications.
But now we are looking for single sign on to Druid using existing active token(with PingFederate).

Could I get some guidance?

Thanks
Soumya

[himanshug]

can you describe what you are hoping to achieve with SSO .. do you need this to ensure that only a limited set of people could use the router web console ?

I haven't used PingFederate but have done above for OpenID Connnect on Okta. From https://www.pingidentity.com/en/software/pingfederate.html it seems like they support OpenID Connect.

[soumyajose0784]

Hi Himanshu,
Thanks for your response. By SSO(single sign on), we are looking to authenticate users to Druid with the exiting active login to the system using their LDAP id. Druid console should not prompt for further login credentials and it should automatically allow the user to access Druid URIs with existing active session. This should also restrict access for unauthorized LDAP ids.

Thanks
Soumya

Thanks you

[himanshug]

I think https://druid.apache.org/docs/latest/development/extensions-core/druid-basic-security.html supports LDAP

[soumyajose0784]

Hi Himanshu,

Plain LDAP auth demand user to enter ldap credentials whenever Druid endpoints are accessed. But the requirement is to authenticate user without entering credentials. For eg, if a user is already logged in to windows machine using LDAP, he should be able to access Druid endpoints with the current active session.

[averma111]

Hi All,

Soumya and Myself works in same team. Let me know if we have options for JWT with Druid?.

Thanks,
Ashish

[himanshug]

sorry, I am a bit occupied this week, so couldn't reply.

if your auth provider supports OpenID Connect then you can potentially use the SSO introduced in #8992 that would release in 0.18.0 .

[averma111]

@himanshug also could you please elaborate on druid-operator how we can utilize it in K8.It say
druid-operator is a kubernetes operator for deploying Druid clusters. Does it help in cluster setup and authentication.

[himanshug]

@averma111 if you use kubernetes then you can use druid-operator. That helps with cluster setup . druid authentication mechanism would be same whether you used druid-operator or not.

which authentication server do you have ... Okta, PingFederate ?

[averma111]

@himanshug we are using PingFederate.

[averma111]

@himanshug - we are deploying druid into GCP Kubernetes. Let me know how to use druid-operator along with OpenId protocal.

[himanshug]

@averma111 how-to for druid–operator is at https://github.com/druid-io/druid-operator , though I haven't personally tried things out on GCP kubernetes but steps should be the same I guess. I would suggest trying those instructions and create issues in https://github.com/druid-io/druid-operator when you hit specific issues.

[himanshug]

Plain LDAP auth demand user to enter ldap credentials whenever Druid endpoints are accessed. But the requirement is to authenticate user without entering credentials. For eg, if a user is already logged in to windows machine using LDAP, he should be able to access Druid endpoints with the current active session.

@jon-wei I think above is because druid-basic-security extension doesn't manage a session with browser via cookies , druid-pac4j does that. To enable LDAP SSO...

1. in druid-basic-security , we could add cookie handling in there.
2. or add ldap support in druid-pac4j which would be easy as pac4j lib does support BASIC auth and LDAP . (see http://www.pac4j.org/docs/index.html )

downside to doing (2) is that we will have ldap in two different extensions then and that might confuse users, so I would favor (1) as that would add SSO for other auth mechanisms present in druid-basic-security ext as well, what do you think ?

[averma111]

@himanshug , To take the latest commit I simply have to mvn clean install druid 0.18 right along with parameters?

[himanshug]

@averma111 #9637 is not merged yet, so that commit needs to be "cherry picked" onto 0.18.0 branch before doing the build.

[averma111]

@himanshug I am new to mvn build what are the steps involved for cherry pick to get the above changes in the new build 0.18