Skip to main content
This guide covers security features in Apache Druid, including TLS encryption, authentication, authorization, and security best practices for production deployments.
By default, security features in Druid are disabled. You must configure security features for production deployments.

​
Security Overview

Druid security encompasses three main areas:

TLS Encryption

Encrypt traffic between clients and services

Authentication

Verify user and service identities

Authorization

Control access to resources and operations

​
Best Practices

​
Cluster Setup

Never run Druid as root. Druid administrators have the same OS permissions as the Unix user running Druid.
If Druid runs as root, administrators can read/write sensitive files like /etc/passwd. Always use a dedicated, unprivileged user:
# Create druid user
sudo useradd -r -s /bin/false druid

# Set ownership
sudo chown -R druid:druid /opt/druid
Enable authentication for any environment accessible by untrusted networks, especially production.
# common.runtime.properties
druid.auth.authenticatorChain=["MyBasicMetadataAuthenticator"]
druid.auth.authenticator.MyBasicMetadataAuthenticator.type=basic
Never expose the web console without authorization enabled. Without authorization, any user has the same privileges as the OS user running Druid.
druid.auth.authorizers=["MyBasicMetadataAuthorizer"]
druid.auth.authorizer.MyBasicMetadataAuthorizer.type=basic
Grant users only the minimum permissions necessary:
  • Read-only users: Only DATASOURCE READ permissions
  • Data engineers: DATASOURCE WRITE for specific datasources only
  • Administrators: Full access, granted only to highly-trusted users
Never use plain-text passwords in configuration files. Use environment variables or secret management:
# Use environment variable provider
druid.metadata.storage.connector.password=${METADATA_STORE_PASSWORD}
See Environment Variable Dynamic Config Provider for more information.
JavaScript functions pose security risks. Disable them unless absolutely required:
druid.javascript.enabled=false

​
Network Security

1

Enable TLS

Encrypt all communication within the cluster and with external clients
2

Use API Gateway

Implement an API gateway to:
  • Restrict access from untrusted networks
  • Create allow lists for specific APIs
  • Implement account lockout and throttling
3

Firewall Configuration

Expose only required ports:
  • Broker ports to query clients
  • Router/Web console to authenticated users
  • Block all other ports from public networks
4

IP Restrictions

Limit access to specific IP addresses or ranges when possible

​
Permission Guidelines

Critical Permissions - Only grant to highly-trusted users:
  • DATASOURCE WRITE: Users can execute arbitrary code with Druid process privileges
  • STATE READ/WRITE: Access to cluster-wide state and resources
  • CONFIG WRITE: Modify cluster configuration
  • EXTERNAL READ: Access to external files and network resources
If less-trusted users control ingestion task input sources, validate all URLs to prevent SSRF attacks against internal resources.

​
TLS Configuration

​
Generate Certificates

1

Generate KeyStore

keytool -keystore keystore.jks -alias druid -genkey -keyalg RSA
2

Export Public Certificate

keytool -export -alias druid -keystore keystore.jks -rfc -file public.cert
3

Create TrustStore

keytool -import -file public.cert -alias druid -keystore truststore.jks
Never use self-signed certificates in production. Use certificates from your organization’s PKI or a trusted CA.

​
Enable TLS

Configure TLS in common.runtime.properties for all Druid services: 
# Enable TLS globally
druid.enableTlsPort=true
druid.enablePlaintextPort=false

# Load TLS extension
druid.extensions.loadList=["simple-client-sslcontext", ...]

# Client-side TLS (for inter-service communication)
druid.client.https.protocol=TLSv1.2
druid.client.https.trustStoreType=jks
druid.client.https.trustStorePath=/etc/druid/truststore.jks
druid.client.https.trustStorePassword=${TRUSTSTORE_PASSWORD}

# Server-side TLS
druid.server.https.keyStoreType=jks
druid.server.https.keyStorePath=/etc/druid/keystore.jks
druid.server.https.keyStorePassword=${KEYSTORE_PASSWORD}
druid.server.https.certAlias=druid
After enabling TLS, all service URLs change from http:// to https:// and ports change from 80xx to 82xx (e.g., Broker: 8082 → 8282).

​
Authentication

​
Enable Basic Authentication

1

Load Extension

Add druid-basic-security to extension load list:
druid.extensions.loadList=["druid-basic-security", ...]
2

Configure Authenticator

druid.auth.authenticatorChain=["MyBasicMetadataAuthenticator"]
druid.auth.authenticator.MyBasicMetadataAuthenticator.type=basic
druid.auth.authenticator.MyBasicMetadataAuthenticator.initialAdminPassword=change_me_admin
druid.auth.authenticator.MyBasicMetadataAuthenticator.initialInternalClientPassword=change_me_internal
druid.auth.authenticator.MyBasicMetadataAuthenticator.credentialsValidator.type=metadata
druid.auth.authenticator.MyBasicMetadataAuthenticator.skipOnFailure=false
druid.auth.authenticator.MyBasicMetadataAuthenticator.authorizerName=MyBasicMetadataAuthorizer
3

Configure Escalator

druid.escalator.type=basic
druid.escalator.internalClientUsername=druid_system
druid.escalator.internalClientPassword=change_me_internal
druid.escalator.authorizerName=MyBasicMetadataAuthorizer
4

Restart Cluster

Restart all Druid services to apply authentication configuration
Change default passwords immediately after first startup. The default admin and druid_system users are created with the passwords specified in configuration.

​
Alternative Authentication Methods

Configure LDAP authentication for integration with existing directory services:
druid.auth.authenticatorChain=["ldap"]
druid.auth.authenticator.ldap.type=basic
druid.auth.authenticator.ldap.credentialsValidator.type=ldap
druid.auth.authenticator.ldap.credentialsValidator.url=ldap://ldap.example.com:389
druid.auth.authenticator.ldap.credentialsValidator.bindUser=cn=admin,dc=example,dc=com
druid.auth.authenticator.ldap.credentialsValidator.bindPassword=${LDAP_BIND_PASSWORD}
druid.auth.authenticator.ldap.credentialsValidator.baseDn=ou=users,dc=example,dc=com
druid.auth.authenticator.ldap.credentialsValidator.userSearch=(&(uid=%s)(objectClass=inetOrgPerson))
See Configure LDAP Authentication for details.

​
Authorization

​
Resource Types

​
DATASOURCE
resource
Individual datasources (tables). Resource names are datasource names or regex patterns.
​
CONFIG
resource
Configuration endpoints. Resource names: CONFIG or security.
​
STATE
resource
Cluster-wide state and status. Resource name: STATE.
​
EXTERNAL
resource
External data access via EXTERN function. Resource name: EXTERNAL.
​
SYSTEM_TABLE
resource
System schema tables in SQL. Resource names are table names like sys.segments.

​
Actions

READ

Read-only operations, queries, and status checks

WRITE

Modify operations, ingestion, and configuration changes
WRITE permission does not include READ. Grant both explicitly if both are needed.

​
Configure Authorization

1

Enable Authorizer

druid.auth.authorizers=["MyBasicMetadataAuthorizer"]
druid.auth.authorizer.MyBasicMetadataAuthorizer.type=basic
2

Create Users

curl -u admin:password -XPOST \
  https://coordinator:8281/druid-ext/basic-security/authentication/db/MyBasicMetadataAuthenticator/users/alice
3

Set User Password

curl -u admin:password -H'Content-Type: application/json' -XPOST \
  https://coordinator:8281/druid-ext/basic-security/authentication/db/MyBasicMetadataAuthenticator/users/alice/credentials \
  --data '{"password": "alice_password"}'
4

Create Authorizer User

curl -u admin:password -XPOST \
  https://coordinator:8281/druid-ext/basic-security/authorization/db/MyBasicMetadataAuthorizer/users/alice
5

Create Roles

curl -u admin:password -XPOST \
  https://coordinator:8281/druid-ext/basic-security/authorization/db/MyBasicMetadataAuthorizer/roles/data-reader
6

Assign Role to User

curl -u admin:password -XPOST \
  https://coordinator:8281/druid-ext/basic-security/authorization/db/MyBasicMetadataAuthorizer/users/alice/roles/data-reader
7

Grant Permissions to Role

curl -u admin:password -H'Content-Type: application/json' -XPOST \
  https://coordinator:8281/druid-ext/basic-security/authorization/db/MyBasicMetadataAuthorizer/roles/data-reader/permissions \
  --data @permissions.json
permissions.json:
[
  {
    "resource": {"type": "DATASOURCE", "name": "wikipedia"},
    "action": "READ"
  },
  {
    "resource": {"type": "STATE", "name": "STATE"},
    "action": "READ"
  }
]

​
Permission Examples

[
  {
    "resource": {"type": "DATASOURCE", "name": ".*"},
    "action": "READ"
  },
  {
    "resource": {"type": "STATE", "name": "STATE"},
    "action": "READ"
  }
]

[
  {
    "resource": {"type": "DATASOURCE", "name": "analytics_.*"},
    "action": "READ"
  },
  {
    "resource": {"type": "DATASOURCE", "name": "analytics_.*"},
    "action": "WRITE"
  },
  {
    "resource": {"type": "STATE", "name": "STATE"},
    "action": "READ"
  }
]

[
  {
    "resource": {"type": "DATASOURCE", "name": ".*"},
    "action": "READ"
  },
  {
    "resource": {"type": "DATASOURCE", "name": ".*"},
    "action": "WRITE"
  },
  {
    "resource": {"type": "CONFIG", "name": ".*"},
    "action": "READ"
  },
  {
    "resource": {"type": "CONFIG", "name": ".*"},
    "action": "WRITE"
  },
  {
    "resource": {"type": "STATE", "name": "STATE"},
    "action": "READ"
  },
  {
    "resource": {"type": "STATE", "name": "STATE"},
    "action": "WRITE"
  }
]

​
Security Trust Model

Druid operates on the following security assumptions:
  1. Druid processes have the same file access as the Unix user running the process
  2. Ingestion tasks can create processes that inherit parent process permissions
  3. Users with DATASOURCE WRITE can access any files/resources the Druid process can access
  1. Druid assumes it operates on an isolated, protected network
  2. Network traffic within the cluster is encrypted (via TLS)
  3. Auxiliary services (metadata store, ZooKeeper) are not under adversary control
  4. Implement firewalls and network security to isolate the cluster
  1. Deep storage security follows the storage system’s native policies
  2. Druid relies on storage system encryption capabilities
  3. Configure appropriate IAM roles/credentials for cloud storage
  1. Clients are authenticated based on configured authenticator
  2. Actions are authorized based on configured authorizer
  3. Default configuration is allowAll (no restrictions)

​
Reporting Security Issues

If you discover a security vulnerability in Druid, do not create a public GitHub issue.
Report security issues privately to: [email protected]

​
Vulnerability Handling Process

  1. Reporter sends vulnerability details to [email protected]
  2. Druid security team acknowledges receipt
  3. Team works privately with reporter to resolve the issue
  4. Team creates a patch and releases a new version
  5. Team publicly announces the vulnerability and fix
For more details, see the Apache Security Committer Guide.

Build docs developers (and LLMs) love

Get started for freeTalk to us