Skip to content

Unable to achieve row-level security and column masking using druid-opa-authorizer plugin #136

@Vinoth721

Description

@Vinoth721

Description:

We are currently working on implementing authentication and authorization in Apache Druid using the druid-opa-authorizer plugin.

  1. Authentication: We successfully configured authentication using Druid’s built-in authenticator (druid-basic-security).

  2. Authorization: We are trying to achieve fine-grained access control specifically:

    • Row-level filtering (restricting access to specific rows based on user identity or role)

    • Column-level masking (masking or hiding sensitive columns from specific users)

However, it seems that the druid-opa-authorizer plugin only supports allow/deny access at the resource level (e.g., datasource or system-level actions).
We are unable to enforce row-level filters or column masking policies through OPA responses.

Could you please confirm:

  • Whether row-level security and column masking are currently supported by the druid-opa-authorizer plugin?

  • If not, is there any planned support or recommended workaround for these features?

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions