maytasm commented on code in PR #20687: URL: https://github.com/apache/druid/pull/20687#discussion_r4380453108
########## docs/operations/security-user-auth.md: ########## @@ -85,6 +86,16 @@ Resource names for this type are datasource names. Specifying a datasource permi Any authenticated user can read the contents of any [lookup](../querying/lookups.md). Avoid storing sensitive data in lookups. ::: +### `LOOKUP` + +When `druid.auth.enableLookupAuthorization` is true, lookup endpoints authorize against `LOOKUP` resources named `tier/lookup`. The tier comes from the URL, bulk request body, coordinator lookup state or the serving node. `READ` covers GET requests, including lookup configuration, status, node status and introspection. `WRITE` covers POST, PUT and DELETE requests. + +This setting applies to lookup HTTP endpoints. It does not currently change lookup use in SQL or native queries, i.e., query execution does not check `LOOKUP` permissions. Review Comment: I recommend keeping the scope of this PR as is, which will make review and approval faster. We can do a follow-up PR to address query authorization. If the follow-up PR lands in the same version as this PR, then we can reuse the same flag. However, if the follow-up PR lands in a later version, we should also think about the rollout and upgrade story. If you reuse the same flag, then for any cluster with this flag enabled (enforcing authorization on lookup endpoints), post-upgrade query lookups might fail if users have not added the necessary authorizations for lookups in their queries. This could be disruptive and even block cluster upgrades. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
