This is an automated email from the ASF dual-hosted git repository.
capistrant pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/druid.git
The following commit(s) were added to refs/heads/master by this push:
new 933c74781ce docs: Clarify some docs on the readOnly basic security
authorizer + update security model (#20609)
933c74781ce is described below
commit 933c74781ceca33a2c9879f48dc195ebd073c5a5
Author: Lucas Capistrant <[email protected]>
AuthorDate: Thu Oct 15 20:50:22 2026 -0500
docs: Clarify some docs on the readOnly basic security authorizer + update
security model (#20609)
---
docs/development/extensions-core/druid-basic-security.md | 6 +++++-
docs/operations/security-overview.md | 2 +-
2 files changed, 6 insertions(+), 2 deletions(-)
diff --git a/docs/development/extensions-core/druid-basic-security.md
b/docs/development/extensions-core/druid-basic-security.md
index 73adb3a80b2..769b18815bf 100644
--- a/docs/development/extensions-core/druid-basic-security.md
+++ b/docs/development/extensions-core/druid-basic-security.md
@@ -416,7 +416,11 @@ Array of LDAP group filters used to filter out the allowed
set of groups returne
#### ReadOnly Authorizer
-The ReadOnly authorizer allows all READ operations and denies all other
operations (WRITE, DELETE, etc.).
+The ReadOnly authorizer allows READ on **all** resources of every type and
denies all other actions (WRITE, DELETE, etc.).
+Please take extra care to consider if you actually intend to grant READ this
broadly before using this authorizer. A few of the more sensitive resources
that this authorizer grants READ access to include:
+
+- [`CONFIG`](../../operations/security-user-auth.md#config) and
[`STATE`](../../operations/security-user-auth.md#state) resources, which expose
cluster configuration and state that is generally not intended for low-trust
users.
+- The [`EXTERNAL`](../../operations/security-user-auth.md#external) resource,
which lets users run SQL queries with the `EXTERN` function and input source
table functions. These queries can read any data the Druid services can reach,
such as files on the local filesystem of Druid servers, HTTP endpoints, and
cloud object storage.
Example configuration:
diff --git a/docs/operations/security-overview.md
b/docs/operations/security-overview.md
index b3cdb346c11..c32099eb359 100644
--- a/docs/operations/security-overview.md
+++ b/docs/operations/security-overview.md
@@ -51,7 +51,7 @@ The following recommendations apply to the network where
Druid runs:
The following recommendation applies to Druid's authorization and
authentication model:
* Only grant `WRITE` permissions to any `DATASOURCE` to trusted users. Druid's
trust model assumes those users have the same privileges as the operating
system user that runs the web console process. Additionally, users with `WRITE`
permissions can make changes to datasources and they have access to both task
and supervisor update (POST) APIs which may affect ingestion.
-* Only grant `STATE READ`, `STATE WRITE`, `CONFIG WRITE`, and `DATASOURCE
WRITE` permissions to highly-trusted users. These permissions allow users to
access resources on behalf of the Druid server process regardless of the
datasource.
+* Only grant `STATE READ`, `STATE WRITE`, `CONFIG READ`, `CONFIG WRITE`, and
`DATASOURCE WRITE` permissions to highly-trusted users. These permissions allow
users to access resources on behalf of the Druid server process regardless of
the datasource.
* If your Druid client application allows less-trusted users to control the
input source of an ingestion task, validate the URLs from the users. It is
possible to point unchecked URLs to other locations and resources within your
network or local file system.
## Enable TLS
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
