<!DOCTYPE html><html lang="en"><head><meta charSet="utf-8"/><meta http-equiv="X-UA-Compatible" content="IE=edge"/><title>Kerberos · Apache Druid</title><meta name="viewport" content="width=device-width, initial-scale=1.0"/><link rel="canonical" href="https://druid.apache.org/docs/24.0.2/development/extensions-core/druid-kerberos.html"/><meta name="generator" content="Docusaurus"/><meta name="description" content="&lt;!--"/><meta name="docsearch:language" content="en"/><meta name="docsearch:version" content="24.0.2" /><meta property="og:title" content="Kerberos · Apache Druid"/><meta property="og:type" content="website"/><meta property="og:url" content="https://druid.apache.org/index.html"/><meta property="og:description" content="&lt;!--"/><meta property="og:image" content="https://druid.apache.org/img/druid_nav.png"/><meta name="twitter:card" content="summary"/><meta name="twitter:image" content="https://druid.apache.org/img/druid_nav.png"/><link rel="shortcut icon" href="/img/favicon.png"/><link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/docsearch.js@2/dist/cdn/docsearch.min.css"/><link rel="stylesheet" href="//cdnjs.cloudflare.com/ajax/libs/highlight.js/9.12.0/styles/default.min.css"/><script async="" src="https://www.googletagmanager.com/gtag/js?id=UA-131010415-1"></script><script>
              window.dataLayer = window.dataLayer || [];
              function gtag(){dataLayer.push(arguments); }
              gtag('js', new Date());
              gtag('config', 'UA-131010415-1');
            </script><link rel="stylesheet" href="https://use.fontawesome.com/releases/v5.7.2/css/all.css"/><link rel="stylesheet" href="/css/code-block-buttons.css"/><script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/clipboard.js/2.0.4/clipboard.min.js"></script><script type="text/javascript" src="/js/code-block-buttons.js"></script><script src="/js/scrollSpy.js"></script><link rel="stylesheet" href="/css/main.css"/><script src="/js/codetabs.js"></script></head><body class="sideNavVisible separateOnPageNav"><div class="fixedHeaderContainer"><div class="headerWrapper wrapper"><header><a href="/"><img class="logo" src="/img/druid_nav.png" alt="Apache Druid"/></a><div class="navigationWrapper navigationSlider"><nav class="slidingNav"><ul class="nav-site nav-site-internal"><li class=""><a href="/technology" target="_self">Technology</a></li><li class=""><a href="/use-cases" target="_self">Use Cases</a></li><li class=""><a href="/druid-powered" target="_self">Powered By</a></li><li class="siteNavGroupActive"><a href="/docs/24.0.2/design/index.html" target="_self">Docs</a></li><li class=""><a href="/community/" target="_self">Community</a></li><li class=""><a href="https://www.apache.org" target="_self">Apache</a></li><li class=""><a href="/downloads.html" target="_self">Download</a></li><li class="navSearchWrapper reactNavSearchWrapper"><input type="text" id="search_input_react" placeholder="Search" title="Search"/></li></ul></nav></div></header></div></div><div class="navPusher"><div class="docMainWrapper wrapper"><div class="docsNavContainer" id="docsNav"><nav class="toc"><div class="toggleNav"><section class="navWrapper wrapper"><div class="navBreadcrumb wrapper"><div class="navToggle" id="navToggler"><div class="hamburger-menu"><div class="line1"></div><div class="line2"></div><div class="line3"></div></div></div><h2><i>›</i><span>Hidden</span></h2><div class="tocToggler" id="tocToggler"><i class="icon-toc"></i></div></div><div class="navGroups"><div class="navGroup"><h3 class="navGroupCategoryTitle collapsible">Getting started<span class="arrow"><svg width="24" height="24" viewBox="0 0 24 24"><path fill="#565656" d="M7.41 15.41L12 10.83l4.59 4.58L18 14l-6-6-6 6z"></path><path d="M0 0h24v24H0z" fill="none"></path></svg></span></h3><ul class="hide"><li class="navListItem"><a class="navItem" href="/docs/24.0.2/design/index.html">Introduction to Apache Druid</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/tutorials/index.html">Quickstart (local)</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/operations/single-server.html">Single server deployment</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/tutorials/cluster.html">Clustered deployment</a></li></ul></div><div class="navGroup"><h3 class="navGroupCategoryTitle collapsible">Tutorials<span class="arrow"><svg width="24" height="24" viewBox="0 0 24 24"><path fill="#565656" d="M7.41 15.41L12 10.83l4.59 4.58L18 14l-6-6-6 6z"></path><path d="M0 0h24v24H0z" fill="none"></path></svg></span></h3><ul class="hide"><li class="navListItem"><a class="navItem" href="/docs/24.0.2/tutorials/tutorial-batch.html">Load files natively</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/tutorials/tutorial-msq-extern.html">Load files using SQL 🆕</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/tutorials/tutorial-kafka.html">Load from Apache Kafka</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/tutorials/tutorial-batch-hadoop.html">Load from Apache Hadoop</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/tutorials/tutorial-query.html">Querying data</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/tutorials/tutorial-rollup.html">Roll-up</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/tutorials/tutorial-sketches-theta.html">Theta sketches</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/tutorials/tutorial-retention.html">Configuring data retention</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/tutorials/tutorial-update-data.html">Updating existing data</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/tutorials/tutorial-compaction.html">Compacting segments</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/tutorials/tutorial-delete-data.html">Deleting data</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/tutorials/tutorial-ingestion-spec.html">Writing an ingestion spec</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/tutorials/tutorial-transform-spec.html">Transforming input data</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/tutorials/docker.html">Tutorial: Run with Docker</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/tutorials/tutorial-kerberos-hadoop.html">Kerberized HDFS deep storage</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/tutorials/tutorial-msq-convert-spec.html">Convert ingestion spec to SQL</a></li></ul></div><div class="navGroup"><h3 class="navGroupCategoryTitle collapsible">Design<span class="arrow"><svg width="24" height="24" viewBox="0 0 24 24"><path fill="#565656" d="M7.41 15.41L12 10.83l4.59 4.58L18 14l-6-6-6 6z"></path><path d="M0 0h24v24H0z" fill="none"></path></svg></span></h3><ul class="hide"><li class="navListItem"><a class="navItem" href="/docs/24.0.2/design/architecture.html">Design</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/design/segments.html">Segments</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/design/processes.html">Processes and servers</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/dependencies/deep-storage.html">Deep storage</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/dependencies/metadata-storage.html">Metadata storage</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/dependencies/zookeeper.html">ZooKeeper</a></li></ul></div><div class="navGroup"><h3 class="navGroupCategoryTitle collapsible">Ingestion<span class="arrow"><svg width="24" height="24" viewBox="0 0 24 24"><path fill="#565656" d="M7.41 15.41L12 10.83l4.59 4.58L18 14l-6-6-6 6z"></path><path d="M0 0h24v24H0z" fill="none"></path></svg></span></h3><ul class="hide"><li class="navListItem"><a class="navItem" href="/docs/24.0.2/ingestion/index.html">Ingestion</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/ingestion/data-formats.html">Data formats</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/ingestion/data-model.html">Data model</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/ingestion/rollup.html">Data rollup</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/ingestion/partitioning.html">Partitioning</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/ingestion/ingestion-spec.html">Ingestion spec</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/ingestion/schema-design.html">Schema design tips</a></li><div class="navGroup subNavGroup"><h4 class="navGroupSubcategoryTitle">Stream ingestion</h4><ul><li class="navListItem"><a class="navItem" href="/docs/24.0.2/development/extensions-core/kafka-ingestion.html">Apache Kafka ingestion</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/development/extensions-core/kafka-supervisor-reference.html">Apache Kafka supervisor</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/development/extensions-core/kafka-supervisor-operations.html">Apache Kafka operations</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/development/extensions-core/kinesis-ingestion.html">Amazon Kinesis</a></li></ul></div><div class="navGroup subNavGroup"><h4 class="navGroupSubcategoryTitle">Batch ingestion</h4><ul><li class="navListItem"><a class="navItem" href="/docs/24.0.2/ingestion/native-batch.html">Native batch</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/ingestion/native-batch-input-sources.html">Native batch: input sources</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/ingestion/hadoop.html">Hadoop-based</a></li></ul></div><div class="navGroup subNavGroup"><h4 class="navGroupSubcategoryTitle">SQL-based ingestion 🆕</h4><ul><li class="navListItem"><a class="navItem" href="/docs/24.0.2/multi-stage-query/index.html">Overview</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/multi-stage-query/concepts.html">Key concepts</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/multi-stage-query/api.html">API</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/multi-stage-query/security.html">Security</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/multi-stage-query/examples.html">Examples</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/multi-stage-query/reference.html">Reference</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/multi-stage-query/known-issues.html">Known issues</a></li></ul></div><li class="navListItem"><a class="navItem" href="/docs/24.0.2/ingestion/tasks.html">Task reference</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/ingestion/faq.html">Troubleshooting FAQ</a></li></ul></div><div class="navGroup"><h3 class="navGroupCategoryTitle collapsible">Data management<span class="arrow"><svg width="24" height="24" viewBox="0 0 24 24"><path fill="#565656" d="M7.41 15.41L12 10.83l4.59 4.58L18 14l-6-6-6 6z"></path><path d="M0 0h24v24H0z" fill="none"></path></svg></span></h3><ul class="hide"><li class="navListItem"><a class="navItem" href="/docs/24.0.2/data-management/index.html">Overview</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/data-management/update.html">Data updates</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/data-management/delete.html">Data deletion</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/data-management/schema-changes.html">Schema changes</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/data-management/compaction.html">Compaction</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/data-management/automatic-compaction.html">Automatic compaction</a></li></ul></div><div class="navGroup"><h3 class="navGroupCategoryTitle collapsible">Querying<span class="arrow"><svg width="24" height="24" viewBox="0 0 24 24"><path fill="#565656" d="M7.41 15.41L12 10.83l4.59 4.58L18 14l-6-6-6 6z"></path><path d="M0 0h24v24H0z" fill="none"></path></svg></span></h3><ul class="hide"><div class="navGroup subNavGroup"><h4 class="navGroupSubcategoryTitle">Druid SQL</h4><ul><li class="navListItem"><a class="navItem" href="/docs/24.0.2/querying/sql.html">Overview and syntax</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/querying/sql-data-types.html">SQL data types</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/querying/sql-operators.html">Operators</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/querying/sql-scalar.html">Scalar functions</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/querying/sql-aggregations.html">Aggregation functions</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/querying/sql-multivalue-string-functions.html">Multi-value string functions</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/querying/sql-json-functions.html">JSON functions</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/querying/sql-functions.html">All functions</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/querying/sql-api.html">Druid SQL API</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/querying/sql-jdbc.html">JDBC driver API</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/querying/sql-query-context.html">SQL query context</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/querying/sql-metadata-tables.html">SQL metadata tables</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/querying/sql-translation.html">SQL query translation</a></li></ul></div><li class="navListItem"><a class="navItem" href="/docs/24.0.2/querying/querying.html">Native queries</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/querying/query-execution.html">Query execution</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/querying/troubleshooting.html">Troubleshooting</a></li><div class="navGroup subNavGroup"><h4 class="navGroupSubcategoryTitle">Concepts</h4><ul><li class="navListItem"><a class="navItem" href="/docs/24.0.2/querying/datasource.html">Datasources</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/querying/joins.html">Joins</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/querying/lookups.html">Lookups</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/querying/multi-value-dimensions.html">Multi-value dimensions</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/querying/nested-columns.html">Nested columns</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/querying/multitenancy.html">Multitenancy</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/querying/caching.html">Query caching</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/querying/using-caching.html">Using query caching</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/querying/query-context.html">Query context</a></li></ul></div><div class="navGroup subNavGroup"><h4 class="navGroupSubcategoryTitle">Native query types</h4><ul><li class="navListItem"><a class="navItem" href="/docs/24.0.2/querying/timeseriesquery.html">Timeseries</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/querying/topnquery.html">TopN</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/querying/groupbyquery.html">GroupBy</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/querying/scan-query.html">Scan</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/querying/searchquery.html">Search</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/querying/timeboundaryquery.html">TimeBoundary</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/querying/segmentmetadataquery.html">SegmentMetadata</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/querying/datasourcemetadataquery.html">DatasourceMetadata</a></li></ul></div><div class="navGroup subNavGroup"><h4 class="navGroupSubcategoryTitle">Native query components</h4><ul><li class="navListItem"><a class="navItem" href="/docs/24.0.2/querying/filters.html">Filters</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/querying/granularities.html">Granularities</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/querying/dimensionspecs.html">Dimensions</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/querying/aggregations.html">Aggregations</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/querying/post-aggregations.html">Post-aggregations</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/misc/math-expr.html">Expressions</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/querying/having.html">Having filters (groupBy)</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/querying/limitspec.html">Sorting and limiting (groupBy)</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/querying/topnmetricspec.html">Sorting (topN)</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/querying/sorting-orders.html">String comparators</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/querying/virtual-columns.html">Virtual columns</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/development/geo.html">Spatial filters</a></li></ul></div></ul></div><div class="navGroup"><h3 class="navGroupCategoryTitle collapsible">Configuration<span class="arrow"><svg width="24" height="24" viewBox="0 0 24 24"><path fill="#565656" d="M7.41 15.41L12 10.83l4.59 4.58L18 14l-6-6-6 6z"></path><path d="M0 0h24v24H0z" fill="none"></path></svg></span></h3><ul class="hide"><li class="navListItem"><a class="navItem" href="/docs/24.0.2/configuration/index.html">Configuration reference</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/development/extensions.html">Extensions</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/configuration/logging.html">Logging</a></li></ul></div><div class="navGroup"><h3 class="navGroupCategoryTitle collapsible">Operations<span class="arrow"><svg width="24" height="24" viewBox="0 0 24 24"><path fill="#565656" d="M7.41 15.41L12 10.83l4.59 4.58L18 14l-6-6-6 6z"></path><path d="M0 0h24v24H0z" fill="none"></path></svg></span></h3><ul class="hide"><li class="navListItem"><a class="navItem" href="/docs/24.0.2/operations/web-console.html">Web console</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/operations/java.html">Java runtime</a></li><div class="navGroup subNavGroup"><h4 class="navGroupSubcategoryTitle">Security</h4><ul><li class="navListItem"><a class="navItem" href="/docs/24.0.2/operations/security-overview.html">Security overview</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/operations/security-user-auth.html">User authentication and authorization</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/operations/auth-ldap.html">LDAP auth</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/operations/password-provider.html">Password providers</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/operations/dynamic-config-provider.html">Dynamic Config Providers</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/operations/tls-support.html">TLS support</a></li></ul></div><div class="navGroup subNavGroup"><h4 class="navGroupSubcategoryTitle">Performance tuning</h4><ul><li class="navListItem"><a class="navItem" href="/docs/24.0.2/operations/basic-cluster-tuning.html">Basic cluster tuning</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/operations/segment-optimization.html">Segment size optimization</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/operations/mixed-workloads.html">Mixed workloads</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/operations/http-compression.html">HTTP compression</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/operations/clean-metadata-store.html">Automated metadata cleanup</a></li></ul></div><div class="navGroup subNavGroup"><h4 class="navGroupSubcategoryTitle">Monitoring</h4><ul><li class="navListItem"><a class="navItem" href="/docs/24.0.2/operations/request-logging.html">Request logging</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/operations/metrics.html">Metrics</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/operations/alerts.html">Alerts</a></li></ul></div><li class="navListItem"><a class="navItem" href="/docs/24.0.2/operations/api-reference.html">API reference</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/operations/high-availability.html">High availability</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/operations/rolling-updates.html">Rolling updates</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/operations/rule-configuration.html">Retaining or automatically dropping data</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/operations/other-hadoop.html">Working with different versions of Apache Hadoop</a></li><div class="navGroup subNavGroup"><h4 class="navGroupSubcategoryTitle">Misc</h4><ul><li class="navListItem"><a class="navItem" href="/docs/24.0.2/operations/dump-segment.html">dump-segment tool</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/operations/reset-cluster.html">reset-cluster tool</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/operations/insert-segment-to-db.html">insert-segment-to-db tool</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/operations/pull-deps.html">pull-deps tool</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/operations/deep-storage-migration.html">Deep storage migration</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/operations/export-metadata.html">Export Metadata Tool</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/operations/metadata-migration.html">Metadata Migration</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/operations/use_sbt_to_build_fat_jar.html">Content for build.sbt</a></li></ul></div></ul></div><div class="navGroup"><h3 class="navGroupCategoryTitle collapsible">Development<span class="arrow"><svg width="24" height="24" viewBox="0 0 24 24"><path fill="#565656" d="M7.41 15.41L12 10.83l4.59 4.58L18 14l-6-6-6 6z"></path><path d="M0 0h24v24H0z" fill="none"></path></svg></span></h3><ul class="hide"><li class="navListItem"><a class="navItem" href="/docs/24.0.2/development/overview.html">Developing on Druid</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/development/modules.html">Creating extensions</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/development/javascript.html">JavaScript functionality</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/development/build.html">Build from source</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/development/versioning.html">Versioning</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/development/experimental.html">Experimental features</a></li></ul></div><div class="navGroup"><h3 class="navGroupCategoryTitle collapsible">Misc<span class="arrow"><svg width="24" height="24" viewBox="0 0 24 24"><path fill="#565656" d="M7.41 15.41L12 10.83l4.59 4.58L18 14l-6-6-6 6z"></path><path d="M0 0h24v24H0z" fill="none"></path></svg></span></h3><ul class="hide"><li class="navListItem"><a class="navItem" href="/docs/24.0.2/misc/papers-and-talks.html">Papers</a></li></ul></div><div class="navGroup"><h3 class="navGroupCategoryTitle collapsible">Hidden<span class="arrow"><svg width="24" height="24" viewBox="0 0 24 24"><path fill="#565656" d="M7.41 15.41L12 10.83l4.59 4.58L18 14l-6-6-6 6z"></path><path d="M0 0h24v24H0z" fill="none"></path></svg></span></h3><ul class="hide"><li class="navListItem"><a class="navItem" href="/docs/24.0.2/comparisons/druid-vs-elasticsearch.html">Apache Druid vs Elasticsearch</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/comparisons/druid-vs-key-value.html">Apache Druid vs. Key/Value Stores (HBase/Cassandra/OpenTSDB)</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/comparisons/druid-vs-kudu.html">Apache Druid vs Kudu</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/comparisons/druid-vs-redshift.html">Apache Druid vs Redshift</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/comparisons/druid-vs-spark.html">Apache Druid vs Spark</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/comparisons/druid-vs-sql-on-hadoop.html">Apache Druid vs SQL-on-Hadoop</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/design/auth.html">Authentication and Authorization</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/design/broker.html">Broker</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/design/coordinator.html">Coordinator Process</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/design/historical.html">Historical Process</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/design/indexer.html">Indexer Process</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/design/indexing-service.html">Indexing Service</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/design/middlemanager.html">MiddleManager Process</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/design/overlord.html">Overlord Process</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/design/router.html">Router Process</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/design/peons.html">Peons</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/development/extensions-core/approximate-histograms.html">Approximate Histogram aggregators</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/development/extensions-core/avro.html">Apache Avro</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/development/extensions-core/azure.html">Microsoft Azure</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/development/extensions-core/bloom-filter.html">Bloom Filter</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/development/extensions-core/datasketches-extension.html">DataSketches extension</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/development/extensions-core/datasketches-hll.html">DataSketches HLL Sketch module</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/development/extensions-core/datasketches-quantiles.html">DataSketches Quantiles Sketch module</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/development/extensions-core/datasketches-theta.html">DataSketches Theta Sketch module</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/development/extensions-core/datasketches-tuple.html">DataSketches Tuple Sketch module</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/development/extensions-core/druid-basic-security.html">Basic Security</a></li><li class="navListItem navListItemActive"><a class="navItem" href="/docs/24.0.2/development/extensions-core/druid-kerberos.html">Kerberos</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/development/extensions-core/druid-lookups.html">Cached Lookup Module</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/development/extensions-core/druid-ranger-security.html">Apache Ranger Security</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/development/extensions-core/google.html">Google Cloud Storage</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/development/extensions-core/hdfs.html">HDFS</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/development/extensions-core/kafka-extraction-namespace.html">Apache Kafka Lookups</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/development/extensions-core/lookups-cached-global.html">Globally Cached Lookups</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/development/extensions-core/mysql.html">MySQL Metadata Store</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/development/extensions-core/orc.html">ORC Extension</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/development/extensions-core/druid-pac4j.html">Druid pac4j based Security extension</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/development/extensions-core/parquet.html">Apache Parquet Extension</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/development/extensions-core/postgresql.html">PostgreSQL Metadata Store</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/development/extensions-core/protobuf.html">Protobuf</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/development/extensions-core/s3.html">S3-compatible</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/development/extensions-core/simple-client-sslcontext.html">Simple SSLContext Provider Module</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/development/extensions-core/stats.html">Stats aggregator</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/development/extensions-core/test-stats.html">Test Stats Aggregators</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/development/extensions-core/druid-aws-rds.html">Druid AWS RDS Module</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/development/extensions-core/kubernetes.html">Kubernetes</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/development/extensions-contrib/ambari-metrics-emitter.html">Ambari Metrics Emitter</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/development/extensions-contrib/cassandra.html">Apache Cassandra</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/development/extensions-contrib/cloudfiles.html">Rackspace Cloud Files</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/development/extensions-contrib/distinctcount.html">DistinctCount Aggregator</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/development/extensions-contrib/graphite.html">Graphite Emitter</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/development/extensions-contrib/influx.html">InfluxDB Line Protocol Parser</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/development/extensions-contrib/influxdb-emitter.html">InfluxDB Emitter</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/development/extensions-contrib/kafka-emitter.html">Kafka Emitter</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/development/extensions-contrib/materialized-view.html">Materialized View</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/development/extensions-contrib/momentsketch-quantiles.html">Moment Sketches for Approximate Quantiles module</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/development/extensions-contrib/moving-average-query.html">Moving Average Query</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/development/extensions-contrib/opentsdb-emitter.html">OpenTSDB Emitter</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/development/extensions-contrib/redis-cache.html">Druid Redis Cache</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/development/extensions-contrib/sqlserver.html">Microsoft SQLServer</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/development/extensions-contrib/statsd.html">StatsD Emitter</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/development/extensions-contrib/tdigestsketch-quantiles.html">T-Digest Quantiles Sketch module</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/development/extensions-contrib/thrift.html">Thrift</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/development/extensions-contrib/time-min-max.html">Timestamp Min/Max aggregators</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/development/extensions-contrib/gce-extensions.html">GCE Extensions</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/development/extensions-contrib/aliyun-oss.html">Aliyun OSS</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/development/extensions-contrib/prometheus.html">Prometheus Emitter</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/operations/kubernetes.html">kubernetes</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/querying/hll-old.html">Cardinality/HyperUnique aggregators</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/querying/select-query.html">Select</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/ingestion/native-batch-firehose.html">Firehose (deprecated)</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/ingestion/native-batch-simple-task.html">Native batch (simple)</a></li><li class="navListItem"><a class="navItem" href="/docs/24.0.2/ingestion/standalone-realtime.html">Realtime Process</a></li></ul></div></div></section></div><script>
            var coll = document.getElementsByClassName('collapsible');
            var checkActiveCategory = true;
            for (var i = 0; i < coll.length; i++) {
              var links = coll[i].nextElementSibling.getElementsByTagName('*');
              if (checkActiveCategory){
                for (var j = 0; j < links.length; j++) {
                  if (links[j].classList.contains('navListItemActive')){
                    coll[i].nextElementSibling.classList.toggle('hide');
                    coll[i].childNodes[1].classList.toggle('rotate');
                    checkActiveCategory = false;
                    break;
                  }
                }
              }

              coll[i].addEventListener('click', function() {
                var arrow = this.childNodes[1];
                arrow.classList.toggle('rotate');
                var content = this.nextElementSibling;
                content.classList.toggle('hide');
              });
            }

            document.addEventListener('DOMContentLoaded', function() {
              createToggler('#navToggler', '#docsNav', 'docsSliderActive');
              createToggler('#tocToggler', 'body', 'tocActive');

              var headings = document.querySelector('.toc-headings');
              headings && headings.addEventListener('click', function(event) {
                var el = event.target;
                while(el !== headings){
                  if (el.tagName === 'A') {
                    document.body.classList.remove('tocActive');
                    break;
                  } else{
                    el = el.parentNode;
                  }
                }
              }, false);

              function createToggler(togglerSelector, targetSelector, className) {
                var toggler = document.querySelector(togglerSelector);
                var target = document.querySelector(targetSelector);

                if (!toggler) {
                  return;
                }

                toggler.onclick = function(event) {
                  event.preventDefault();

                  target.classList.toggle(className);
                };
              }
            });
        </script></nav></div><div class="container mainContainer docsContainer"><div class="wrapper"><div class="post"><header class="postHeader"><a class="edit-page-link button" href="https://github.com/apache/druid/edit/master/docs/development/extensions-core/druid-kerberos.md" target="_blank" rel="noreferrer noopener">Edit</a><h1 id="__docusaurus" class="postHeaderTitle">Kerberos</h1></header><article><div><span><!--
  ~ Licensed to the Apache Software Foundation (ASF) under one
  ~ or more contributor license agreements.  See the NOTICE file
  ~ distributed with this work for additional information
  ~ regarding copyright ownership.  The ASF licenses this file
  ~ to you under the Apache License, Version 2.0 (the
  ~ "License"); you may not use this file except in compliance
  ~ with the License.  You may obtain a copy of the License at
  ~
  ~   http://www.apache.org/licenses/LICENSE-2.0
  ~
  ~ Unless required by applicable law or agreed to in writing,
  ~ software distributed under the License is distributed on an
  ~ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
  ~ KIND, either express or implied.  See the License for the
  ~ specific language governing permissions and limitations
  ~ under the License.
  -->
<p>Apache Druid Extension to enable Authentication for Druid Processes using Kerberos.
This extension adds an Authenticator which is used to protect HTTP Endpoints using the simple and protected GSSAPI negotiation mechanism <a href="https://en.wikipedia.org/wiki/SPNEGO">SPNEGO</a>.
Make sure to <a href="/docs/24.0.2/development/extensions.html#loading-extensions">include</a> <code>druid-kerberos</code> in the extensions load list.</p>
<h2><a class="anchor" aria-hidden="true" id="configuration"></a><a href="#configuration" aria-hidden="true" class="hash-link"><svg class="hash-link-icon" aria-hidden="true" height="16" version="1.1" viewBox="0 0 16 16" width="16"><path fill-rule="evenodd" d="M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z"></path></svg></a>Configuration</h2>
<h3><a class="anchor" aria-hidden="true" id="creating-an-authenticator"></a><a href="#creating-an-authenticator" aria-hidden="true" class="hash-link"><svg class="hash-link-icon" aria-hidden="true" height="16" version="1.1" viewBox="0 0 16 16" width="16"><path fill-rule="evenodd" d="M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z"></path></svg></a>Creating an Authenticator</h3>
<pre><code class="hljs"><span class="hljs-attr">druid.auth.authenticatorChain</span>=[<span class="hljs-string">"MyKerberosAuthenticator"</span>]

<span class="hljs-attr">druid.auth.authenticator.MyKerberosAuthenticator.type</span>=kerberos
</code></pre>
<p>To use the Kerberos authenticator, add an authenticator with type <code>kerberos</code> to the authenticatorChain. The example above uses the name &quot;MyKerberosAuthenticator&quot; for the Authenticator.</p>
<p>Configuration of the named authenticator is assigned through properties with the form:</p>
<pre><code class="hljs">druid.auth.authenticator.<span class="hljs-tag">&lt;<span class="hljs-name">authenticatorName</span>&gt;</span>.<span class="hljs-tag">&lt;<span class="hljs-name">authenticatorProperty</span>&gt;</span>
</code></pre>
<p>The configuration examples in the rest of this document will use &quot;kerberos&quot; as the name of the authenticator being configured.</p>
<h3><a class="anchor" aria-hidden="true" id="properties"></a><a href="#properties" aria-hidden="true" class="hash-link"><svg class="hash-link-icon" aria-hidden="true" height="16" version="1.1" viewBox="0 0 16 16" width="16"><path fill-rule="evenodd" d="M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z"></path></svg></a>Properties</h3>
<table>
<thead>
<tr><th>Property</th><th>Possible Values</th><th>Description</th><th>Default</th><th>required</th></tr>
</thead>
<tbody>
<tr><td><code>druid.auth.authenticator.kerberos.serverPrincipal</code></td><td><code>HTTP/_HOST@EXAMPLE.COM</code></td><td>SPNEGO service principal used by druid processes</td><td>empty</td><td>Yes</td></tr>
<tr><td><code>druid.auth.authenticator.kerberos.serverKeytab</code></td><td><code>/etc/security/keytabs/spnego.service.keytab</code></td><td>SPNego service keytab used by druid processes</td><td>empty</td><td>Yes</td></tr>
<tr><td><code>druid.auth.authenticator.kerberos.authToLocal</code></td><td><code>RULE:[1:$1@$0](druid@EXAMPLE.COM)s/.*/druid DEFAULT</code></td><td>It allows you to set a general rule for mapping principal names to local user names. It will be used if there is not an explicit mapping for the principal name that is being translated.</td><td>DEFAULT</td><td>No</td></tr>
<tr><td><code>druid.auth.authenticator.kerberos.cookieSignatureSecret</code></td><td><code>secretString</code></td><td>Secret used to sign authentication cookies. It is advisable to explicitly set it, if you have multiple druid nodes running on same machine with different ports as the Cookie Specification does not guarantee isolation by port.</td><td>Random value</td><td>No</td></tr>
<tr><td><code>druid.auth.authenticator.kerberos.authorizerName</code></td><td>Depends on available authorizers</td><td>Authorizer that requests should be directed to</td><td>Empty</td><td>Yes</td></tr>
</tbody>
</table>
<p>As a note, it is required that the SPNego principal in use by the druid processes must start with HTTP (This specified by <a href="https://tools.ietf.org/html/rfc4559">RFC-4559</a>) and must be of the form &quot;HTTP/_HOST@REALM&quot;.
The special string _HOST will be replaced automatically with the value of config <code>druid.host</code></p>
<h3><a class="anchor" aria-hidden="true" id="druidauthauthenticatorkerberosexcludedpaths"></a><a href="#druidauthauthenticatorkerberosexcludedpaths" aria-hidden="true" class="hash-link"><svg class="hash-link-icon" aria-hidden="true" height="16" version="1.1" viewBox="0 0 16 16" width="16"><path fill-rule="evenodd" d="M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z"></path></svg></a><code>druid.auth.authenticator.kerberos.excludedPaths</code></h3>
<p>In older releases, the Kerberos authenticator had an <code>excludedPaths</code> property that allowed the user to specify a list of paths where authentication checks should be skipped. This property has been removed from the Kerberos authenticator because the path exclusion functionality is now handled across all authenticators/authorizers by setting <code>druid.auth.unsecuredPaths</code>, as described in the <a href="/docs/24.0.2/design/auth.html">main auth documentation</a>.</p>
<h3><a class="anchor" aria-hidden="true" id="auth-to-local-syntax"></a><a href="#auth-to-local-syntax" aria-hidden="true" class="hash-link"><svg class="hash-link-icon" aria-hidden="true" height="16" version="1.1" viewBox="0 0 16 16" width="16"><path fill-rule="evenodd" d="M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z"></path></svg></a>Auth to Local Syntax</h3>
<p><code>druid.auth.authenticator.kerberos.authToLocal</code> allows you to set a general rules for mapping principal names to local user names.
The syntax for mapping rules is <code>RULE:\[n:string](regexp)s/pattern/replacement/g</code>. The integer n indicates how many components the target principal should have. If this matches, then a string will be formed from string, substituting the realm of the principal for $0 and the nth component of the principal for $n. e.g. if the principal was druid/admin then <code>\[2:$2$1suffix]</code> would result in the string <code>admindruidsuffix</code>.
If this string matches regexp, then the s//[g] substitution command will be run over the string. The optional g will cause the substitution to be global over the string, instead of replacing only the first match in the string.
If required, multiple rules can be joined by newline character and specified as a String.</p>
<h3><a class="anchor" aria-hidden="true" id="increasing-http-header-size-for-large-spnego-negotiate-header"></a><a href="#increasing-http-header-size-for-large-spnego-negotiate-header" aria-hidden="true" class="hash-link"><svg class="hash-link-icon" aria-hidden="true" height="16" version="1.1" viewBox="0 0 16 16" width="16"><path fill-rule="evenodd" d="M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z"></path></svg></a>Increasing HTTP Header size for large SPNEGO negotiate header</h3>
<p>In Active Directory environment, SPNEGO token in the Authorization header includes PAC (Privilege Access Certificate) information,
which includes all security groups for the user. In some cases when the user belongs to many security groups the header to grow beyond what druid can handle by default.
In such cases, max request header size that druid can handle can be increased by setting <code>druid.server.http.maxRequestHeaderSize</code> (default 8KiB) and <code>druid.router.http.maxRequestBufferSize</code> (default 8KiB).</p>
<h2><a class="anchor" aria-hidden="true" id="configuring-kerberos-escalated-client"></a><a href="#configuring-kerberos-escalated-client" aria-hidden="true" class="hash-link"><svg class="hash-link-icon" aria-hidden="true" height="16" version="1.1" viewBox="0 0 16 16" width="16"><path fill-rule="evenodd" d="M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z"></path></svg></a>Configuring Kerberos Escalated Client</h2>
<p>Druid internal processes communicate with each other using an escalated http Client. A Kerberos enabled escalated HTTP Client can be configured by following properties -</p>
<table>
<thead>
<tr><th>Property</th><th>Example Values</th><th>Description</th><th>Default</th><th>required</th></tr>
</thead>
<tbody>
<tr><td><code>druid.escalator.type</code></td><td><code>kerberos</code></td><td>Type of Escalator client used for internal process communication.</td><td>n/a</td><td>Yes</td></tr>
<tr><td><code>druid.escalator.internalClientPrincipal</code></td><td><code>druid@EXAMPLE.COM</code></td><td>Principal user name, used for internal process communication</td><td>n/a</td><td>Yes</td></tr>
<tr><td><code>druid.escalator.internalClientKeytab</code></td><td><code>/etc/security/keytabs/druid.keytab</code></td><td>Path to keytab file used for internal process communication</td><td>n/a</td><td>Yes</td></tr>
<tr><td><code>druid.escalator.authorizerName</code></td><td><code>MyBasicAuthorizer</code></td><td>Authorizer that requests should be directed to.</td><td>n/a</td><td>Yes</td></tr>
</tbody>
</table>
<h2><a class="anchor" aria-hidden="true" id="accessing-druid-http-end-points-when-kerberos-security-is-enabled"></a><a href="#accessing-druid-http-end-points-when-kerberos-security-is-enabled" aria-hidden="true" class="hash-link"><svg class="hash-link-icon" aria-hidden="true" height="16" version="1.1" viewBox="0 0 16 16" width="16"><path fill-rule="evenodd" d="M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z"></path></svg></a>Accessing Druid HTTP end points when kerberos security is enabled</h2>
<ol>
<li><p>To access druid HTTP endpoints via curl user will need to first login using <code>kinit</code> command as follows -</p>
<pre><code class="hljs">kinit -k -t <span class="hljs-variable">&lt;path_to_keytab_file&gt;</span> user<span class="hljs-meta">@REALM.COM</span>
</code></pre></li>
<li><p>Once the login is successful verify that login is successful using <code>klist</code> command</p></li>
<li><p>Now you can access druid HTTP endpoints using curl command as follows -</p>
<pre><code class="hljs">curl --negotiate -u:anyUser -<span class="hljs-selector-tag">b</span> ~/cookies<span class="hljs-selector-class">.txt</span> -c ~/cookies<span class="hljs-selector-class">.txt</span> -X POST -H<span class="hljs-string">'Content-Type: application/json'</span> &lt;HTTP_END_POINT&gt;
</code></pre>
<p>e.g to send a query from file <code>query.json</code> to the Druid Broker use this command -</p>
<pre><code class="hljs">curl --negotiate -<span class="hljs-string">u:</span>anyUser -b <span class="hljs-regexp">~/cookies.txt -c ~/</span>cookies.txt -X POST -H<span class="hljs-string">'Content-Type: application/json'</span>  <span class="hljs-string">http:</span><span class="hljs-comment">//broker-host:port/druid/v2/?pretty -d @query.json</span>
</code></pre>
<p>Note: Above command will authenticate the user first time using SPNego negotiate mechanism and store the authentication cookie in file. For subsequent requests the cookie will be used for authentication.</p></li>
</ol>
<h2><a class="anchor" aria-hidden="true" id="accessing-coordinator-or-overlord-console-from-web-browser"></a><a href="#accessing-coordinator-or-overlord-console-from-web-browser" aria-hidden="true" class="hash-link"><svg class="hash-link-icon" aria-hidden="true" height="16" version="1.1" viewBox="0 0 16 16" width="16"><path fill-rule="evenodd" d="M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z"></path></svg></a>Accessing Coordinator or Overlord console from web browser</h2>
<p>To access Coordinator/Overlord console from browser you will need to configure your browser for SPNego authentication as follows -</p>
<ol>
<li>Safari - No configurations required.</li>
<li>Firefox - Open firefox and follow these steps -
<ol>
<li>Go to <code>about:config</code> and search for <code>network.negotiate-auth.trusted-uris</code>.</li>
<li>Double-click and add the following values: <code>&quot;http://druid-coordinator-hostname:ui-port&quot;</code> and <code>&quot;http://druid-overlord-hostname:port&quot;</code></li>
</ol></li>
<li>Google Chrome - From the command line run following commands -
<ol>
<li><code>google-chrome --auth-server-whitelist=&quot;druid-coordinator-hostname&quot; --auth-negotiate-delegate-whitelist=&quot;druid-coordinator-hostname&quot;</code></li>
<li><code>google-chrome --auth-server-whitelist=&quot;druid-overlord-hostname&quot; --auth-negotiate-delegate-whitelist=&quot;druid-overlord-hostname&quot;</code></li>
</ol></li>
<li>Internet Explorer -
<ol>
<li>Configure trusted websites to include <code>&quot;druid-coordinator-hostname&quot;</code> and <code>&quot;druid-overlord-hostname&quot;</code></li>
<li>Allow negotiation for the UI website.</li>
</ol></li>
</ol>
<h2><a class="anchor" aria-hidden="true" id="sending-queries-programmatically"></a><a href="#sending-queries-programmatically" aria-hidden="true" class="hash-link"><svg class="hash-link-icon" aria-hidden="true" height="16" version="1.1" viewBox="0 0 16 16" width="16"><path fill-rule="evenodd" d="M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z"></path></svg></a>Sending Queries programmatically</h2>
<p>Many HTTP client libraries, such as Apache Commons <a href="https://hc.apache.org/">HttpComponents</a>, already have support for performing SPNEGO authentication. You can use any of the available HTTP client library to communicate with druid cluster.</p>
</span></div></article></div><div class="docs-prevnext"><a class="docs-prev button" href="/docs/24.0.2/development/extensions-core/druid-basic-security.html"><span class="arrow-prev">← </span><span>Basic Security</span></a><a class="docs-next button" href="/docs/24.0.2/development/extensions-core/druid-lookups.html"><span>Cached Lookup Module</span><span class="arrow-next"> →</span></a></div></div></div><nav class="onPageNav"><ul class="toc-headings"><li><a href="#configuration">Configuration</a><ul class="toc-headings"><li><a href="#creating-an-authenticator">Creating an Authenticator</a></li><li><a href="#properties">Properties</a></li><li><a href="#druidauthauthenticatorkerberosexcludedpaths"><code>druid.auth.authenticator.kerberos.excludedPaths</code></a></li><li><a href="#auth-to-local-syntax">Auth to Local Syntax</a></li><li><a href="#increasing-http-header-size-for-large-spnego-negotiate-header">Increasing HTTP Header size for large SPNEGO negotiate header</a></li></ul></li><li><a href="#configuring-kerberos-escalated-client">Configuring Kerberos Escalated Client</a></li><li><a href="#accessing-druid-http-end-points-when-kerberos-security-is-enabled">Accessing Druid HTTP end points when kerberos security is enabled</a></li><li><a href="#accessing-coordinator-or-overlord-console-from-web-browser">Accessing Coordinator or Overlord console from web browser</a></li><li><a href="#sending-queries-programmatically">Sending Queries programmatically</a></li></ul></nav></div><footer class="nav-footer druid-footer" id="footer"><div class="container"><div class="text-center"><p><a href="/technology">Technology</a> · <a href="/use-cases">Use Cases</a> · <a href="/druid-powered">Powered by Druid</a> · <a href="/docs/24.0.2/">Docs</a> · <a href="/community/">Community</a> · <a href="/downloads.html">Download</a> · <a href="/faq">FAQ</a></p></div><div class="text-center"><a title="Join the user group" href="https://groups.google.com/forum/#!forum/druid-user" target="_blank"><span class="fa fa-comments"></span></a> · <a title="Follow Druid" href="https://twitter.com/druidio" target="_blank"><span class="fab fa-twitter"></span></a> · <a title="Download via Apache" href="https://www.apache.org/dyn/closer.cgi?path=/incubator/druid/{{ site.druid_versions[0].versions[0].version }}/apache-druid-{{ site.druid_versions[0].versions[0].version }}-bin.tar.gz" target="_blank"><span class="fas fa-feather"></span></a> · <a title="GitHub" href="https://github.com/apache/druid" target="_blank"><span class="fab fa-github"></span></a></div><div class="text-center license">Copyright © 2022 <a href="https://www.apache.org/" target="_blank">Apache Software Foundation</a>.<br/>Except where otherwise noted, licensed under <a rel="license" href="http://creativecommons.org/licenses/by-sa/4.0/">CC BY-SA 4.0</a>.<br/>Apache Druid, Druid, and the Druid logo are either registered trademarks or trademarks of The Apache Software Foundation in the United States and other countries.</div></div></footer></div><script type="text/javascript" src="https://cdn.jsdelivr.net/npm/docsearch.js@2/dist/cdn/docsearch.min.js"></script><script>
                document.addEventListener('keyup', function(e) {
                  if (e.target !== document.body) {
                    return;
                  }
                  // keyCode for '/' (slash)
                  if (e.keyCode === 191) {
                    const search = document.getElementById('search_input_react');
                    search && search.focus();
                  }
                });
              </script><script>
              var search = docsearch({
                appId: 'CPK9PMSCEY',
                apiKey: 'd4ef4ffe3a2f0c7d1e34b062fd98736b',
                indexName: 'apache_druid',
                inputSelector: '#search_input_react',
                algoliaOptions: {"facetFilters":["language:en","version:24.0.2"]}
              });
            </script></body></html>