apache/druid · error · IllegalArgumentException

authenticationResult is null where it should never be.

Error message

authenticationResult is null where it should never be.

What it means

Defensive guard in RangerAuthorizer.authorize: authorization is invoked with a null AuthenticationResult, which should be impossible after successful authentication. A null here indicates an upstream wiring problem (authorizer called outside an authenticated request context), so the authorizer fails fast rather than NPE later.

Solutions

1. Ensure requests reaching this authorizer have passed through Druid authentication and that the authenticator chain is correctly configured.
2. Check for custom extensions or internal calls that invoke Authorizer.authorize directly without an AuthenticationResult.
3. Review server logs upstream of this error to find which request path produced a null identity.

When it happens

Trigger: Thrown at extensions-contrib/druid-ranger-security/src/main/java/org/apache/druid/security/ranger/authorizer/RangerAuthorizer.java:90 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of apache/druid@9b90983fd2 (2026-09-07). Data as JSON: /api/errors/4bcb96943456f974. Report an issue: GitHub.

Appendix: source

Thrown at extensions-contrib/druid-ranger-security/src/main/java/org/apache/druid/security/ranger/authorizer/RangerAuthorizer.java:90

      try {
        UserGroupInformation.loginUserFromKeytab(principal, keytab);
      }
      catch (IOException ioe) {
        throw new RuntimeException(ioe);
      }
    }

    rangerPlugin = new RangerBasePlugin(RANGER_DRUID_SERVICETYPE, RANGER_DRUID_APPID);
    rangerPlugin.init();
    rangerPlugin.setResultProcessor(new RangerDefaultAuditHandler());

  }

  @Override
  public Access authorize(AuthenticationResult authenticationResult, Resource resource, Action action)
  {
    if (authenticationResult == null) {
      throw new IAE("authenticationResult is null where it should never be.");
    }

    Set<String> userGroups = null;
    if (useUgi) {
      UserGroupInformation ugi = UserGroupInformation.createRemoteUser(authenticationResult.getIdentity());
      String[] groups = ugi != null ? ugi.getGroupNames() : null;
      if (groups != null && groups.length > 0) {
        userGroups = new HashSet<>(Arrays.asList(groups));
      }
    }

    RangerDruidResource rangerDruidResource = new RangerDruidResource(resource);
    RangerDruidAccessRequest request = new RangerDruidAccessRequest(
        rangerDruidResource,
        authenticationResult.getIdentity(),
        userGroups,
        action
    );

View on GitHub (pinned to 9b90983fd2)