apache/druid · error

Authentication exception:

Error message

Authentication exception: 

What it means

In doFilterSuper(), an AuthenticationException raised by the filter's own processing (rather than from token parsing) is treated as fatal: the response code is set to HTTP 403 FORBIDDEN and the exception is logged as "Authentication exception: <message>" (warn level, debug if enabled). Unlike the token-ignored case, the request will not proceed as anonymous.

Source

Thrown at extensions-core/druid-kerberos/src/main/java/org/apache/druid/security/kerberos/KerberosAuthenticator.java:339

              // Since this request is validated also set DRUID_AUTHENTICATION_RESULT
              request.setAttribute(
                  AuthConfig.DRUID_AUTHENTICATION_RESULT,
                  new AuthenticationResult(token.getName(), authorizerName, name, null)
              );
              doFilter(filterChain, httpRequest, httpResponse);
            }
          } else {
            unauthorizedResponse = false;
          }
        }
        catch (AuthenticationException ex) {
          // exception from the filter itself is fatal
          errCode = HttpServletResponse.SC_FORBIDDEN;
          authenticationEx = ex;
          if (log.isDebugEnabled()) {
            log.debug(ex, "Authentication exception: " + ex.getMessage());
          } else {
            log.warn("Authentication exception: " + ex.getMessage());
          }
        }
        if (unauthorizedResponse) {
          if (!httpResponse.isCommitted()) {
            tokenToAuthCookie(
                httpResponse,
                "",
                getCookieDomain(),
                getCookiePath(),
                0,
                false,
                isHttps
            );
            // If response code is 401. Then WWW-Authenticate Header should be
            // present.. reset to 403 if not found..
            if ((errCode == HttpServletResponse.SC_UNAUTHORIZED)
                && (!httpResponse.containsHeader(
                org.apache.hadoop.security.authentication.client.KerberosAuthenticator.WWW_AUTHENTICATE))) {

View on GitHub (pinned to 9b90983fd2)

Solutions

1. Inspect the logged exception message and its cause to find whether the SPNEGO handshake or handler state failed.
2. Verify server Kerberos init succeeded (no earlier 'Failed to login as' errors) and the keytab/principal are correct.
3. Confirm the client is obtaining tickets for the correct service principal and realm (kvno mismatches, cross-realm issues).
4. Fix or reinitialize the authenticator: restart the Druid process after correcting Kerberos configuration.

Example fix

// before
// client ticket for HTTP/other-host@REALM -> 403
// after
// ensure client uses the SPN matching druid.auth.kerberos.principal, e.g.:
// curl --negotiate -u : https://druid-host:8081/status

// server-side: ensure handler init succeeded before serving
if (!authHandlerReady) { response.sendError(503); return; }

When it happens

Trigger: Authentication handler (e.g. DruidKerberosAuthenticationHandler) or token/auth-cookie validation inside the filter throws after token parsing succeeded: SPNEGO context negotiation failure, handler management-operation error, or unexpected internal exception wrapped as AuthenticationException.

Common situations: Broken Kerberos server-side configuration (bad keytab/principal at init), GSS context accept failures from clients presenting tickets for the wrong realm/service, cookie signature/decryption problems.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Failed to login as [%s]
• AuthenticationToken ignored:
• Principal not defined in configuration
• Principals do not exist in the keytab
• Failed to authenticate user principal [%s] with keytab [%s]

AI-assisted analysis of apache/druid@9b90983fd2 (2026-09-07). Data as JSON: /api/errors/2e9366ef492928ee. Report an issue: GitHub.