"use strict";(self.webpackChunk=self.webpackChunk||[]).push([[2362],{3905:(e,t,r)=>{r.d(t,{Zo:()=>u,kt:()=>k});var a=r(67294);function n(e,t,r){return t in e?Object.defineProperty(e,t,{value:r,enumerable:!0,configurable:!0,writable:!0}):e[t]=r,e}function i(e,t){var r=Object.keys(e);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);t&&(a=a.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),r.push.apply(r,a)}return r}function o(e){for(var t=1;t<arguments.length;t++){var r=null!=arguments[t]?arguments[t]:{};t%2?i(Object(r),!0).forEach((function(t){n(e,t,r[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(r)):i(Object(r)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(r,t))}))}return e}function l(e,t){if(null==e)return{};var r,a,n=function(e,t){if(null==e)return{};var r,a,n={},i=Object.keys(e);for(a=0;a<i.length;a++)r=i[a],t.indexOf(r)>=0||(n[r]=e[r]);return n}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(a=0;a<i.length;a++)r=i[a],t.indexOf(r)>=0||Object.prototype.propertyIsEnumerable.call(e,r)&&(n[r]=e[r])}return n}var s=a.createContext({}),d=function(e){var t=a.useContext(s),r=t;return e&&(r="function"==typeof e?e(t):o(o({},t),e)),r},u=function(e){var t=d(e.components);return a.createElement(s.Provider,{value:t},e.children)},p="mdxType",m={inlineCode:"code",wrapper:function(e){var t=e.children;return a.createElement(a.Fragment,{},t)}},c=a.forwardRef((function(e,t){var r=e.components,n=e.mdxType,i=e.originalType,s=e.parentName,u=l(e,["components","mdxType","originalType","parentName"]),p=d(r),c=n,k=p["".concat(s,".").concat(c)]||p[c]||m[c]||i;return r?a.createElement(k,o(o({ref:t},u),{},{components:r})):a.createElement(k,o({ref:t},u))}));function k(e,t){var r=arguments,n=t&&t.mdxType;if("string"==typeof e||n){var i=r.length,o=new Array(i);o[0]=c;var l={};for(var s in t)hasOwnProperty.call(t,s)&&(l[s]=t[s]);l.originalType=e,l[p]="string"==typeof e?e:n,o[1]=l;for(var d=2;d<i;d++)o[d]=r[d];return a.createElement.apply(null,o)}return a.createElement.apply(null,r)}c.displayName="MDXCreateElement"},65907:(e,t,r)=>{r.r(t),r.d(t,{assets:()=>u,contentTitle:()=>s,default:()=>k,frontMatter:()=>l,metadata:()=>d,toc:()=>p});var a=r(87462),n=r(63366),i=(r(67294),r(3905)),o=["components"],l={id:"security-user-auth",title:"User authentication and authorization"},s=void 0,d={unversionedId:"operations/security-user-auth",id:"operations/security-user-auth",title:"User authentication and authorization",description:"\x3c!--",source:"@site/docs/28.0.0/operations/security-user-auth.md",sourceDirName:"operations",slug:"/operations/security-user-auth",permalink:"/docs/28.0.0/operations/security-user-auth",draft:!1,tags:[],version:"current",frontMatter:{id:"security-user-auth",title:"User authentication and authorization"},sidebar:"docs",previous:{title:"Security overview",permalink:"/docs/28.0.0/operations/security-overview"},next:{title:"LDAP auth",permalink:"/docs/28.0.0/operations/auth-ldap"}},u={},p=[{value:"Authentication and authorization model",id:"authentication-and-authorization-model",level:2},{value:"Resource types",id:"resource-types",level:3},{value:"Actions",id:"actions",level:3},{value:"User types",id:"user-types",level:3},{value:"Default user accounts",id:"default-user-accounts",level:2},{value:"Authenticator",id:"authenticator",level:3},{value:"Authorizer",id:"authorizer",level:3},{value:"Defining permissions",id:"defining-permissions",level:2},{value:"<code>DATASOURCE</code>",id:"datasource",level:3},{value:"<code>CONFIG</code>",id:"config",level:3},{value:"<code>EXTERNAL</code>",id:"external",level:3},{value:"<code>STATE</code>",id:"state",level:3},{value:"<code>SYSTEM_TABLE</code>",id:"system_table",level:3},{value:"HTTP methods",id:"http-methods",level:3},{value:"SQL permissions",id:"sql-permissions",level:3},{value:"Configuration propagation",id:"configuration-propagation",level:2}],m={toc:p},c="wrapper";function k(e){var t=e.components,r=(0,n.Z)(e,o);return(0,i.kt)(c,(0,a.Z)({},m,r,{components:t,mdxType:"MDXLayout"}),(0,i.kt)("p",null,"This document describes the Druid security model that extensions use to enable user authentication and authorization services to Druid. "),(0,i.kt)("h2",{id:"authentication-and-authorization-model"},"Authentication and authorization model"),(0,i.kt)("p",null,"At the center of the Druid user authentication and authorization model are ",(0,i.kt)("em",{parentName:"p"},"resources")," and ",(0,i.kt)("em",{parentName:"p"},"actions"),". A resource is something that authenticated users are trying to access or modify. An action is something that users are trying to do. "),(0,i.kt)("h3",{id:"resource-types"},"Resource types"),(0,i.kt)("p",null,"Druid uses the following resource types:"),(0,i.kt)("ul",null,(0,i.kt)("li",{parentName:"ul"},"DATASOURCE ","\u2013"," Each Druid table (i.e., ",(0,i.kt)("inlineCode",{parentName:"li"},"tables")," in the ",(0,i.kt)("inlineCode",{parentName:"li"},"druid")," schema in SQL) is a resource."),(0,i.kt)("li",{parentName:"ul"},"CONFIG ","\u2013"," Configuration resources exposed by the cluster components. "),(0,i.kt)("li",{parentName:"ul"},"EXTERNAL ","\u2013"," External data read through the ",(0,i.kt)("a",{parentName:"li",href:"/docs/28.0.0/multi-stage-query/concepts#extern"},"EXTERN function")," in SQL."),(0,i.kt)("li",{parentName:"ul"},"STATE ","\u2013"," Cluster-wide state resources."),(0,i.kt)("li",{parentName:"ul"},"SYSTEM_TABLE ","\u2013"," when the Broker property ",(0,i.kt)("inlineCode",{parentName:"li"},"druid.sql.planner.authorizeSystemTablesDirectly")," is true, then Druid uses this resource type to authorize the system tables in the ",(0,i.kt)("inlineCode",{parentName:"li"},"sys")," schema in SQL.")),(0,i.kt)("p",null,"For specific resources associated with the resource types, see ",(0,i.kt)("a",{parentName:"p",href:"#defining-permissions"},"Defining permissions")," and the corresponding endpoint descriptions in ",(0,i.kt)("a",{parentName:"p",href:"/docs/28.0.0/api-reference/"},"API reference"),"."),(0,i.kt)("h3",{id:"actions"},"Actions"),(0,i.kt)("p",null,"Users perform one of the following actions on resources:"),(0,i.kt)("ul",null,(0,i.kt)("li",{parentName:"ul"},"READ ","\u2013"," Used for read-only operations."),(0,i.kt)("li",{parentName:"ul"},"WRITE ","\u2013"," Used for operations that are not read-only.")),(0,i.kt)("p",null,"WRITE permission on a resource does not include READ permission. If a user requires both READ and WRITE permissions on a resource, you must grant them both explicitly. For instance, a user with only ",(0,i.kt)("inlineCode",{parentName:"p"},"DATASOURCE READ")," permission\nmight have access to an API or a system schema record that a user with ",(0,i.kt)("inlineCode",{parentName:"p"},"DATASOURCE WRITE")," permission would not have access to."),(0,i.kt)("h3",{id:"user-types"},"User types"),(0,i.kt)("p",null,"In practice, most deployments will only need to define two classes of users: "),(0,i.kt)("ul",null,(0,i.kt)("li",{parentName:"ul"},"Administrators, who have WRITE action permissions on all resource types. These users will add datasources and administer the system.  "),(0,i.kt)("li",{parentName:"ul"},"Data users, who only need READ access to DATASOURCE. These users should access Query APIs only through an API gateway. Other APIs and permissions include functionality that should be limited to server admins. ")),(0,i.kt)("p",null,"It is important to note that WRITE access to DATASOURCE grants a user broad access. For instance, such users will have access to the Druid file system, S3 buckets, and credentials, among other things. As such, the ability to add and manage datasources should be allocated selectively to administrators.   "),(0,i.kt)("h2",{id:"default-user-accounts"},"Default user accounts"),(0,i.kt)("h3",{id:"authenticator"},"Authenticator"),(0,i.kt)("p",null,"If ",(0,i.kt)("inlineCode",{parentName:"p"},"druid.auth.authenticator.<authenticator-name>.initialAdminPassword"),' is set, a default admin user named "admin" will be created, with the specified initial password. If this configuration is omitted, the "admin" user will not be created.'),(0,i.kt)("p",null,"If ",(0,i.kt)("inlineCode",{parentName:"p"},"druid.auth.authenticator.<authenticator-name>.initialInternalClientPassword"),' is set, a default internal system user named "druid_system" will be created, with the specified initial password. If this configuration is omitted, the "druid_system" user will not be created.'),(0,i.kt)("h3",{id:"authorizer"},"Authorizer"),(0,i.kt)("p",null,'Each Authorizer will always have a default "admin" and "druid_system" user with full privileges.'),(0,i.kt)("h2",{id:"defining-permissions"},"Defining permissions"),(0,i.kt)("p",null,"You define permissions that you then grant to user groups.\nPermissions are defined by resource type, action, and resource name.\nThis section describes the resource names available for each resource type."),(0,i.kt)("h3",{id:"datasource"},(0,i.kt)("inlineCode",{parentName:"h3"},"DATASOURCE")),(0,i.kt)("p",null,"Resource names for this type are datasource names. Specifying a datasource permission allows the administrator to grant users access to specific datasources."),(0,i.kt)("h3",{id:"config"},(0,i.kt)("inlineCode",{parentName:"h3"},"CONFIG")),(0,i.kt)("p",null,'There are two possible resource names for the "CONFIG" resource type, "CONFIG" and "security". Granting a user access to CONFIG resources allows them to access the following endpoints.'),(0,i.kt)("p",null,'"CONFIG" resource name covers the following endpoints:'),(0,i.kt)("table",null,(0,i.kt)("thead",{parentName:"table"},(0,i.kt)("tr",{parentName:"thead"},(0,i.kt)("th",{parentName:"tr",align:null},"Endpoint"),(0,i.kt)("th",{parentName:"tr",align:null},"Process Type"))),(0,i.kt)("tbody",{parentName:"table"},(0,i.kt)("tr",{parentName:"tbody"},(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("inlineCode",{parentName:"td"},"/druid/coordinator/v1/config")),(0,i.kt)("td",{parentName:"tr",align:null},"coordinator")),(0,i.kt)("tr",{parentName:"tbody"},(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("inlineCode",{parentName:"td"},"/druid/indexer/v1/worker")),(0,i.kt)("td",{parentName:"tr",align:null},"overlord")),(0,i.kt)("tr",{parentName:"tbody"},(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("inlineCode",{parentName:"td"},"/druid/indexer/v1/worker/history")),(0,i.kt)("td",{parentName:"tr",align:null},"overlord")),(0,i.kt)("tr",{parentName:"tbody"},(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("inlineCode",{parentName:"td"},"/druid/worker/v1/disable")),(0,i.kt)("td",{parentName:"tr",align:null},"middleManager")),(0,i.kt)("tr",{parentName:"tbody"},(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("inlineCode",{parentName:"td"},"/druid/worker/v1/enable")),(0,i.kt)("td",{parentName:"tr",align:null},"middleManager")))),(0,i.kt)("p",null,'"security" resource name covers the following endpoint:'),(0,i.kt)("table",null,(0,i.kt)("thead",{parentName:"table"},(0,i.kt)("tr",{parentName:"thead"},(0,i.kt)("th",{parentName:"tr",align:null},"Endpoint"),(0,i.kt)("th",{parentName:"tr",align:null},"Process Type"))),(0,i.kt)("tbody",{parentName:"table"},(0,i.kt)("tr",{parentName:"tbody"},(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("inlineCode",{parentName:"td"},"/druid-ext/basic-security/authentication")),(0,i.kt)("td",{parentName:"tr",align:null},"coordinator")),(0,i.kt)("tr",{parentName:"tbody"},(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("inlineCode",{parentName:"td"},"/druid-ext/basic-security/authorization")),(0,i.kt)("td",{parentName:"tr",align:null},"coordinator")))),(0,i.kt)("h3",{id:"external"},(0,i.kt)("inlineCode",{parentName:"h3"},"EXTERNAL")),(0,i.kt)("p",null,'The EXTERNAL resource type only accepts the resource name "EXTERNAL".\nGranting a user access to EXTERNAL resources allows them to run queries that include\nthe ',(0,i.kt)("a",{parentName:"p",href:"/docs/28.0.0/multi-stage-query/concepts#extern"},"EXTERN function")," in SQL\nto read external data."),(0,i.kt)("h3",{id:"state"},(0,i.kt)("inlineCode",{parentName:"h3"},"STATE")),(0,i.kt)("p",null,'There is only one possible resource name for the "STATE" config resource type, "STATE". Granting a user access to STATE resources allows them to access the following endpoints.'),(0,i.kt)("p",null,'"STATE" resource name covers the following endpoints:'),(0,i.kt)("table",null,(0,i.kt)("thead",{parentName:"table"},(0,i.kt)("tr",{parentName:"thead"},(0,i.kt)("th",{parentName:"tr",align:null},"Endpoint"),(0,i.kt)("th",{parentName:"tr",align:null},"Process Type"))),(0,i.kt)("tbody",{parentName:"table"},(0,i.kt)("tr",{parentName:"tbody"},(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("inlineCode",{parentName:"td"},"/druid/coordinator/v1")),(0,i.kt)("td",{parentName:"tr",align:null},"coordinator")),(0,i.kt)("tr",{parentName:"tbody"},(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("inlineCode",{parentName:"td"},"/druid/coordinator/v1/rules")),(0,i.kt)("td",{parentName:"tr",align:null},"coordinator")),(0,i.kt)("tr",{parentName:"tbody"},(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("inlineCode",{parentName:"td"},"/druid/coordinator/v1/rules/history")),(0,i.kt)("td",{parentName:"tr",align:null},"coordinator")),(0,i.kt)("tr",{parentName:"tbody"},(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("inlineCode",{parentName:"td"},"/druid/coordinator/v1/servers")),(0,i.kt)("td",{parentName:"tr",align:null},"coordinator")),(0,i.kt)("tr",{parentName:"tbody"},(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("inlineCode",{parentName:"td"},"/druid/coordinator/v1/tiers")),(0,i.kt)("td",{parentName:"tr",align:null},"coordinator")),(0,i.kt)("tr",{parentName:"tbody"},(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("inlineCode",{parentName:"td"},"/druid/broker/v1")),(0,i.kt)("td",{parentName:"tr",align:null},"broker")),(0,i.kt)("tr",{parentName:"tbody"},(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("inlineCode",{parentName:"td"},"/druid/v2/candidates")),(0,i.kt)("td",{parentName:"tr",align:null},"broker")),(0,i.kt)("tr",{parentName:"tbody"},(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("inlineCode",{parentName:"td"},"/druid/indexer/v1/leader")),(0,i.kt)("td",{parentName:"tr",align:null},"overlord")),(0,i.kt)("tr",{parentName:"tbody"},(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("inlineCode",{parentName:"td"},"/druid/indexer/v1/isLeader")),(0,i.kt)("td",{parentName:"tr",align:null},"overlord")),(0,i.kt)("tr",{parentName:"tbody"},(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("inlineCode",{parentName:"td"},"/druid/indexer/v1/action")),(0,i.kt)("td",{parentName:"tr",align:null},"overlord")),(0,i.kt)("tr",{parentName:"tbody"},(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("inlineCode",{parentName:"td"},"/druid/indexer/v1/workers")),(0,i.kt)("td",{parentName:"tr",align:null},"overlord")),(0,i.kt)("tr",{parentName:"tbody"},(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("inlineCode",{parentName:"td"},"/druid/indexer/v1/scaling")),(0,i.kt)("td",{parentName:"tr",align:null},"overlord")),(0,i.kt)("tr",{parentName:"tbody"},(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("inlineCode",{parentName:"td"},"/druid/worker/v1/enabled")),(0,i.kt)("td",{parentName:"tr",align:null},"middleManager")),(0,i.kt)("tr",{parentName:"tbody"},(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("inlineCode",{parentName:"td"},"/druid/worker/v1/tasks")),(0,i.kt)("td",{parentName:"tr",align:null},"middleManager")),(0,i.kt)("tr",{parentName:"tbody"},(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("inlineCode",{parentName:"td"},"/druid/worker/v1/task/{taskid}/shutdown")),(0,i.kt)("td",{parentName:"tr",align:null},"middleManager")),(0,i.kt)("tr",{parentName:"tbody"},(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("inlineCode",{parentName:"td"},"/druid/worker/v1/task/{taskid}/log")),(0,i.kt)("td",{parentName:"tr",align:null},"middleManager")),(0,i.kt)("tr",{parentName:"tbody"},(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("inlineCode",{parentName:"td"},"/druid/historical/v1")),(0,i.kt)("td",{parentName:"tr",align:null},"historical")),(0,i.kt)("tr",{parentName:"tbody"},(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("inlineCode",{parentName:"td"},"/druid-internal/v1/segments/")),(0,i.kt)("td",{parentName:"tr",align:null},"historical")),(0,i.kt)("tr",{parentName:"tbody"},(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("inlineCode",{parentName:"td"},"/druid-internal/v1/segments/")),(0,i.kt)("td",{parentName:"tr",align:null},"peon")),(0,i.kt)("tr",{parentName:"tbody"},(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("inlineCode",{parentName:"td"},"/druid-internal/v1/segments/")),(0,i.kt)("td",{parentName:"tr",align:null},"realtime")),(0,i.kt)("tr",{parentName:"tbody"},(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("inlineCode",{parentName:"td"},"/status")),(0,i.kt)("td",{parentName:"tr",align:null},"all process types")))),(0,i.kt)("h3",{id:"system_table"},(0,i.kt)("inlineCode",{parentName:"h3"},"SYSTEM_TABLE")),(0,i.kt)("p",null,"Resource names for this type are system schema table names in the ",(0,i.kt)("inlineCode",{parentName:"p"},"sys")," schema in SQL, for example ",(0,i.kt)("inlineCode",{parentName:"p"},"sys.segments")," and ",(0,i.kt)("inlineCode",{parentName:"p"},"sys.server_segments"),". Druid only enforces authorization for ",(0,i.kt)("inlineCode",{parentName:"p"},"SYSTEM_TABLE")," resources when the Broker property ",(0,i.kt)("inlineCode",{parentName:"p"},"druid.sql.planner.authorizeSystemTablesDirectly")," is true."),(0,i.kt)("h3",{id:"http-methods"},"HTTP methods"),(0,i.kt)("p",null,"For information on what HTTP methods are supported on a particular request endpoint, refer to ",(0,i.kt)("a",{parentName:"p",href:"/docs/28.0.0/api-reference/"},"API reference"),"."),(0,i.kt)("p",null,(0,i.kt)("inlineCode",{parentName:"p"},"GET")," requests require READ permissions, while ",(0,i.kt)("inlineCode",{parentName:"p"},"POST")," and ",(0,i.kt)("inlineCode",{parentName:"p"},"DELETE")," requests require WRITE permissions."),(0,i.kt)("h3",{id:"sql-permissions"},"SQL permissions"),(0,i.kt)("p",null,"Queries on Druid datasources require DATASOURCE READ permissions for the specified datasource."),(0,i.kt)("p",null,"Queries to access external data through the ",(0,i.kt)("a",{parentName:"p",href:"/docs/28.0.0/multi-stage-query/concepts#extern"},"EXTERN function")," require EXTERNAL READ permissions."),(0,i.kt)("p",null,"Queries on ",(0,i.kt)("a",{parentName:"p",href:"/docs/28.0.0/querying/sql-metadata-tables#information-schema"},"INFORMATION_SCHEMA tables")," return information about datasources that the caller has DATASOURCE READ access to. Other\ndatasources are omitted."),(0,i.kt)("p",null,"Queries on the ",(0,i.kt)("a",{parentName:"p",href:"/docs/28.0.0/querying/sql-metadata-tables#system-schema"},"system schema tables")," require the following permissions:"),(0,i.kt)("ul",null,(0,i.kt)("li",{parentName:"ul"},(0,i.kt)("inlineCode",{parentName:"li"},"segments"),": Druid filters segments according to DATASOURCE READ permissions."),(0,i.kt)("li",{parentName:"ul"},(0,i.kt)("inlineCode",{parentName:"li"},"servers"),": The user requires STATE READ permissions."),(0,i.kt)("li",{parentName:"ul"},(0,i.kt)("inlineCode",{parentName:"li"},"server_segments"),": The user requires STATE READ permissions. Druid filters segments according to DATASOURCE READ permissions."),(0,i.kt)("li",{parentName:"ul"},(0,i.kt)("inlineCode",{parentName:"li"},"tasks"),": Druid filters tasks according to DATASOURCE READ permissions."),(0,i.kt)("li",{parentName:"ul"},(0,i.kt)("inlineCode",{parentName:"li"},"supervisors"),": Druid filters supervisors according to DATASOURCE READ permissions.")),(0,i.kt)("p",null,"When the Broker property ",(0,i.kt)("inlineCode",{parentName:"p"},"druid.sql.planner.authorizeSystemTablesDirectly")," is true, users also require  ",(0,i.kt)("inlineCode",{parentName:"p"},"SYSTEM_TABLE")," authorization on a system schema table to query it."),(0,i.kt)("h2",{id:"configuration-propagation"},"Configuration propagation"),(0,i.kt)("p",null,"To prevent excessive load on the Coordinator, the Authenticator and Authorizer user/role Druid metadata store state is cached on each Druid process."),(0,i.kt)("p",null,"Each process will periodically poll the Coordinator for the latest Druid metadata store state, controlled by the ",(0,i.kt)("inlineCode",{parentName:"p"},"druid.auth.basic.common.pollingPeriod")," and ",(0,i.kt)("inlineCode",{parentName:"p"},"druid.auth.basic.common.maxRandomDelay")," properties."),(0,i.kt)("p",null,"When a configuration update occurs, the Coordinator can optionally notify each process with the updated Druid metadata store state. This behavior is controlled by the ",(0,i.kt)("inlineCode",{parentName:"p"},"enableCacheNotifications")," and ",(0,i.kt)("inlineCode",{parentName:"p"},"cacheNotificationTimeout")," properties on Authenticators and Authorizers."),(0,i.kt)("p",null,"Note that because of the caching, changes made to the user/role Druid metadata store may not be immediately reflected at each Druid process."))}k.isMDXComponent=!0}}]);