[nishantmonu51]

This PR adds a new config druid.auth.unsecuredPaths which allows users to set custom unsecured paths.

[jon-wei]

Suggest adding this to AuthConfig instead using druid.auth.unsecuredPaths, so that all of the general auth-related parameters are in one place

[nishantmonu51]

done.

[jon-wei]

There are some checks in AuthorizationUtils that check for bugs where the code authorizes a request multiple times:

    if (request.getAttribute(AuthConfig.DRUID_AUTHORIZATION_CHECKED) != null) {
      throw new ISE("Request already had authorization check.");
    }

Prior to this patch, UNSECURED_PATHS only contained paths that did not have authorization checks.

With this patch, this check would need to be adjusted so that these functions no-op when the path is already allowed through the unsecured paths config.

Perhaps UnsecuredResourceFilter could add a new flag that indicates the request was allowed through the unsecured paths configuration.

[nishantmonu51]

@jon-wei : Made changes are per your comments.

[jon-wei]

Let's remove the "allowUnsecured" condition here, it's sufficient to check for just authInfoChecked since UnsecuredResourceFilter sets that attribute

[jon-wei]

Ah sorry, misread this, thought this was another area, please ignore the above comment

[jon-wei]

Had one comment, latest changes look good aside from that, there are some real unit test failures with the mocks not expecting the new attribute

Can you also add something to the integration tests? There's already a test set up in ITBasicAuthConfigurationTest, I think you can add a normally secure path to this new config and call makeRequest to that path with an uncredentialed http client for each node (like in checkNodeAccess)

[nishantmonu51]

@jon-wei done.

[jon-wei]

👍 after travis