apache/druid · warning · WebApplicationException

Access-Check-Result

Error message

Access-Check-Result: %s

What it means

Not a thrown exception but the HTTP 403 response body produced by BasicSecurityResourceFilter.filter when the authorization check denies a request. The filter calls checkAccess via the AuthorizerMapper and, if the Access object does not allow access with no restriction, it returns a FORBIDDEN response whose entity is 'Access-Check-Result: <errorMessage>'. The errorMessage explains why access was denied.

Solutions

  1. Read the errorMessage in the response body to see the denial reason
  2. Check which roles the user has via the basic-security /users API and compare with required permissions
  3. Add or fix the role's permission entries (resource name/type/action) in the authorizer configuration
  4. Verify group mappings correctly assign users to roles

Example fix

// before (client sees 403)
curl -u basicUser:pass http://coordinator/druid-ext/basic-security/... 
// after: grant the role permission first
curl -u admin:pass -X POST http://coordinator/druid-ext/basic-security/authorizer/basic/roles/<role> -H 'Content-Type: application/json' -d '{"resource":{"name":".*","type":"DATASOURCE"},"action":"READ"}'
Defensive patterns

Strategy: validation

Validate before calling

// client-side precheck
boolean canAccess(AuthorizerMapper mapper, AuthenticationResult auth, Resource r, Action a) {
  return mapper.getAuthorizer(auth.getAuthorizerName()) != null
      && checkAccess(mapper, auth, r, a).isAllowed();
}

Try / catch

try { invokeProtectedApi(); } catch (ForbiddenException | WebApplicationException e) { if (((WebApplicationException) e).getResponse().getStatus() == 403) { LOG.error("Access-Check-Result: %s", e.getResponse().readEntity(String.class)); } }

Prevention

When it happens

Trigger: Any authenticated request to a basic-security-protected resource where the user's roles lack the required resource/action permission — e.g. a user without admin role calling the coordinator/druid basic-security API, or a role with insufficient resource name/type filters.

Common situations: User assigned roles missing READ/WRITE permissions on the resource; role resource filters restricted to a different datasource prefix; credentials valid (auth passed) but authorization failed; misconfigured group mappings not granting expected roles.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

AI-assisted analysis of apache/druid@9b90983fd2 (2026-09-07). Data as JSON: /api/errors/2d993f18c5ec522b. Report an issue: GitHub.

Appendix: source

Thrown at extensions-core/druid-basic-security/src/main/java/org/apache/druid/security/basic/BasicSecurityResourceFilter.java:64

    super(authorizerMapper);
  }

  @Override
  public ContainerRequest filter(ContainerRequest request)
  {
    final ResourceAction resourceAction = new ResourceAction(
        new Resource(SECURITY_RESOURCE_NAME, ResourceType.CONFIG),
        getAction(request)
    );

    final AuthorizationResult authResult = AuthorizationUtils.authorizeResourceAction(
        getReq(),
        resourceAction,
        getAuthorizerMapper()
    );

    if (!authResult.allowAccessWithNoRestriction()) {
      throw new WebApplicationException(
          Response.status(Response.Status.FORBIDDEN)
                  .type(MediaType.TEXT_PLAIN)
                  .entity(StringUtils.format("Access-Check-Result: %s", authResult.getErrorMessage()))
                  .build()
      );
    }

    return request;
  }
}

View on GitHub (pinned to 9b90983fd2)