"use strict";(self.webpackChunk=self.webpackChunk||[]).push([[5898],{3905:(e,t,r)=>{r.d(t,{Zo:()=>d,kt:()=>v});var n=r(67294);function a(e,t,r){return t in e?Object.defineProperty(e,t,{value:r,enumerable:!0,configurable:!0,writable:!0}):e[t]=r,e}function o(e,t){var r=Object.keys(e);if(Object.getOwnPropertySymbols){var n=Object.getOwnPropertySymbols(e);t&&(n=n.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),r.push.apply(r,n)}return r}function s(e){for(var t=1;t<arguments.length;t++){var r=null!=arguments[t]?arguments[t]:{};t%2?o(Object(r),!0).forEach((function(t){a(e,t,r[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(r)):o(Object(r)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(r,t))}))}return e}function i(e,t){if(null==e)return{};var r,n,a=function(e,t){if(null==e)return{};var r,n,a={},o=Object.keys(e);for(n=0;n<o.length;n++)r=o[n],t.indexOf(r)>=0||(a[r]=e[r]);return a}(e,t);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);for(n=0;n<o.length;n++)r=o[n],t.indexOf(r)>=0||Object.prototype.propertyIsEnumerable.call(e,r)&&(a[r]=e[r])}return a}var p=n.createContext({}),l=function(e){var t=n.useContext(p),r=t;return e&&(r="function"==typeof e?e(t):s(s({},t),e)),r},d=function(e){var t=l(e.components);return n.createElement(p.Provider,{value:t},e.children)},c="mdxType",u={inlineCode:"code",wrapper:function(e){var t=e.children;return n.createElement(n.Fragment,{},t)}},m=n.forwardRef((function(e,t){var r=e.components,a=e.mdxType,o=e.originalType,p=e.parentName,d=i(e,["components","mdxType","originalType","parentName"]),c=l(r),m=a,v=c["".concat(p,".").concat(m)]||c[m]||u[m]||o;return r?n.createElement(v,s(s({ref:t},d),{},{components:r})):n.createElement(v,s({ref:t},d))}));function v(e,t){var r=arguments,a=t&&t.mdxType;if("string"==typeof e||a){var o=r.length,s=new Array(o);s[0]=m;var i={};for(var p in t)hasOwnProperty.call(t,p)&&(i[p]=t[p]);i.originalType=e,i[c]="string"==typeof e?e:a,s[1]=i;for(var l=2;l<o;l++)s[l]=r[l];return n.createElement.apply(null,s)}return n.createElement.apply(null,r)}m.displayName="MDXCreateElement"},9875:(e,t,r)=>{r.r(t),r.d(t,{assets:()=>d,contentTitle:()=>p,default:()=>v,frontMatter:()=>i,metadata:()=>l,toc:()=>c});var n=r(87462),a=r(63366),o=(r(67294),r(3905)),s=["components"],i={id:"password-provider",title:"Password providers"},p=void 0,l={unversionedId:"operations/password-provider",id:"operations/password-provider",title:"Password providers",description:"\x3c!--",source:"@site/docs/latest/operations/password-provider.md",sourceDirName:"operations",slug:"/operations/password-provider",permalink:"/docs/latest/operations/password-provider",draft:!1,tags:[],version:"current",frontMatter:{id:"password-provider",title:"Password providers"},sidebar:"docs",previous:{title:"LDAP auth",permalink:"/docs/latest/operations/auth-ldap"},next:{title:"Dynamic Config Providers",permalink:"/docs/latest/operations/dynamic-config-provider"}},d={},c=[],u={toc:c},m="wrapper";function v(e){var t=e.components,r=(0,a.Z)(e,s);return(0,o.kt)(m,(0,n.Z)({},u,r,{components:t,mdxType:"MDXLayout"}),(0,o.kt)("p",null,"Passwords help secure Apache Druid systems such as the metadata store and the keystore that contains server certificates, and so on."),(0,o.kt)("p",null,"These passwords have corresponding runtime properties associated with them, for example ",(0,o.kt)("inlineCode",{parentName:"p"},"druid.metadata.storage.connector.password")," corresponds to the metadata store password."),(0,o.kt)("p",null,"By default users can directly set the passwords in plaintext for runtime properties. For example, ",(0,o.kt)("inlineCode",{parentName:"p"},"druid.metadata.storage.connector.password=pwd")," sets the password to be used by Druid to connect to the metadata store to ",(0,o.kt)("inlineCode",{parentName:"p"},"pwd"),". Alternatively, users can can set passwords as environment variables."),(0,o.kt)("p",null,"Environment variable passwords allow users to avoid exposing passwords in the ",(0,o.kt)("inlineCode",{parentName:"p"},"runtime.properties")," file. "),(0,o.kt)("p",null,"You can set an environment variable password as in the following example: "),(0,o.kt)("pre",null,(0,o.kt)("code",{parentName:"pre",className:"language-json"},'druid.metadata.storage.connector.password={ "type": "environment", "variable": "METADATA_STORAGE_PASSWORD" }\n')),(0,o.kt)("p",null,"The values are described below."),(0,o.kt)("table",null,(0,o.kt)("thead",{parentName:"table"},(0,o.kt)("tr",{parentName:"thead"},(0,o.kt)("th",{parentName:"tr",align:null},"Field"),(0,o.kt)("th",{parentName:"tr",align:null},"Type"),(0,o.kt)("th",{parentName:"tr",align:null},"Description"),(0,o.kt)("th",{parentName:"tr",align:null},"Required"))),(0,o.kt)("tbody",{parentName:"table"},(0,o.kt)("tr",{parentName:"tbody"},(0,o.kt)("td",{parentName:"tr",align:null},(0,o.kt)("inlineCode",{parentName:"td"},"type")),(0,o.kt)("td",{parentName:"tr",align:null},"String"),(0,o.kt)("td",{parentName:"tr",align:null},"password provider type"),(0,o.kt)("td",{parentName:"tr",align:null},"Yes: ",(0,o.kt)("inlineCode",{parentName:"td"},"environment"))),(0,o.kt)("tr",{parentName:"tbody"},(0,o.kt)("td",{parentName:"tr",align:null},(0,o.kt)("inlineCode",{parentName:"td"},"variable")),(0,o.kt)("td",{parentName:"tr",align:null},"String"),(0,o.kt)("td",{parentName:"tr",align:null},"environment variable to read password from"),(0,o.kt)("td",{parentName:"tr",align:null},"Yes")))),(0,o.kt)("p",null,"Another option that provides even greater control is to securely fetch passwords at runtime using a custom extension of the ",(0,o.kt)("inlineCode",{parentName:"p"},"PasswordProvider")," interface that is registered at Druid process startup."),(0,o.kt)("p",null,"For more information, see ",(0,o.kt)("a",{parentName:"p",href:"/docs/latest/development/modules#adding-a-new-password-provider-implementation"},"Adding a new Password Provider implementation"),"."),(0,o.kt)("p",null,"To use this implementation, simply set the relevant password runtime property similarly to how was shown for the environment variable password: "),(0,o.kt)("pre",null,(0,o.kt)("code",{parentName:"pre",className:"language-json"},'druid.metadata.storage.connector.password={ "type": "<registered_password_provider_name>", "<jackson_property>": "<value>", ... }\n')))}v.isMDXComponent=!0}}]);