apache/druid · warning · WebApplicationException

Access-Check-Result: %s

Error message

Access-Check-Result: %s

What it means

Not a thrown exception but the HTTP 403 response body produced by BasicSecurityResourceFilter.filter when the authorization check denies a request. The filter calls checkAccess via the AuthorizerMapper and, if the Access object does not allow access with no restriction, it returns a FORBIDDEN response whose entity is 'Access-Check-Result: <errorMessage>'. The errorMessage explains why access was denied.

Source

Thrown at extensions-core/druid-basic-security/src/main/java/org/apache/druid/security/basic/BasicSecurityResourceFilter.java:64

    super(authorizerMapper);
  }

  @Override
  public ContainerRequest filter(ContainerRequest request)
  {
    final ResourceAction resourceAction = new ResourceAction(
        new Resource(SECURITY_RESOURCE_NAME, ResourceType.CONFIG),
        getAction(request)
    );

    final AuthorizationResult authResult = AuthorizationUtils.authorizeResourceAction(
        getReq(),
        resourceAction,
        getAuthorizerMapper()
    );

    if (!authResult.allowAccessWithNoRestriction()) {
      throw new WebApplicationException(
          Response.status(Response.Status.FORBIDDEN)
                  .type(MediaType.TEXT_PLAIN)
                  .entity(StringUtils.format("Access-Check-Result: %s", authResult.getErrorMessage()))
                  .build()
      );
    }

    return request;
  }
}

View on GitHub (pinned to 9b90983fd2)

Solutions

1. Read the errorMessage in the response body to see the denial reason
2. Check which roles the user has via the basic-security /users API and compare with required permissions
3. Add or fix the role's permission entries (resource name/type/action) in the authorizer configuration
4. Verify group mappings correctly assign users to roles

Example fix

// before (client sees 403)
curl -u basicUser:pass http://coordinator/druid-ext/basic-security/... 
// after: grant the role permission first
curl -u admin:pass -X POST http://coordinator/druid-ext/basic-security/authorizer/basic/roles/<role> -H 'Content-Type: application/json' -d '{"resource":{"name":".*","type":"DATASOURCE"},"action":"READ"}'

// client-side precheck
boolean canAccess(AuthorizerMapper mapper, AuthenticationResult auth, Resource r, Action a) {
  return mapper.getAuthorizer(auth.getAuthorizerName()) != null
      && checkAccess(mapper, auth, r, a).isAllowed();
}

try { invokeProtectedApi(); } catch (ForbiddenException | WebApplicationException e) { if (((WebApplicationException) e).getResponse().getStatus() == 403) { LOG.error("Access-Check-Result: %s", e.getResponse().readEntity(String.class)); } }

When it happens

Trigger: Any authenticated request to a basic-security-protected resource where the user's roles lack the required resource/action permission — e.g. a user without admin role calling the coordinator/druid basic-security API, or a role with insufficient resource name/type filters.

Common situations: User assigned roles missing READ/WRITE permissions on the resource; role resource filters restricted to a different datasource prefix; credentials valid (auth passed) but authorization failed; misconfigured group mappings not granting expected roles.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• Cannot create table definitions in schema: %s
• Task type [%s], does not support input source based security
• Access-Check-Result: %s
• authResult.getErrorMessage()
• authResult.getErrorMessage()

AI-assisted analysis of apache/druid@9b90983fd2 (2026-09-07). Data as JSON: /api/errors/2d993f18c5ec522b. Report an issue: GitHub.