apache/druid · warning · AuthenticationException

AuthenticationToken expired

Error message

AuthenticationToken expired

What it means

getToken() rejects an AuthenticationToken whose expiry timestamp has passed (token.isExpired()). The kerberos-authenticated session cookie is no longer valid and the user must renegotiate SPNEGO to get a new token.

Source

Thrown at extensions-core/druid-kerberos/src/main/java/org/apache/druid/security/kerberos/KerberosAuthenticator.java:207

            if (cookie.getName().equals(AuthenticatedURL.AUTH_COOKIE)) {
              tokenStr = cookie.getValue();
              try {
                tokenStr = mySigner.verifyAndExtract(tokenStr);
              }
              catch (SignerException ex) {
                throw new AuthenticationException(ex);
              }
              break;
            }
          }
        }
        if (tokenStr != null) {
          token = AuthenticationToken.parse(tokenStr);
          if (!token.getType().equals(getAuthenticationHandler().getType())) {
            throw new AuthenticationException("Invalid AuthenticationToken type");
          }
          if (token.isExpired()) {
            throw new AuthenticationException("AuthenticationToken expired");
          }
        }
        return token;
      }

      @Override
      public void doFilter(ServletRequest request, ServletResponse response, FilterChain filterChain)
          throws IOException, ServletException
      {
        // If there's already an auth result, then we have authenticated already, skip this.
        if (request.getAttribute(AuthConfig.DRUID_AUTHENTICATION_RESULT) != null) {
          filterChain.doFilter(request, response);
          return;
        }

        // In the hadoop-auth 2.7.3 code that this was adapted from, the login would've occurred during init() of
        // the AuthenticationFilter via `initializeAuthHandler(authHandlerClassName, filterConfig)`.
        // Since we co-exist with other authentication schemes, don't login until we've checked that

View on GitHub (pinned to 9b90983fd2)

Solutions

1. Re-authenticate (re-run kinit / reload the page to trigger SPNEGO renegotiation)
2. Increase druid.auth.authenticationSessionMillis if sessions are expiring too quickly
3. Synchronize clocks across the cluster (NTP) if skew is causing premature expiry

Example fix

// before
props.setProperty("druid.auth.authenticationSessionMillis", "900000"); // 15 min, too short
// after
props.setProperty("druid.auth.authenticationSessionMillis", "3600000"); // 1 hour

// client-side: check stored token expiry before reusing the cookie
boolean expired = tokenExpiryMillis > 0 && System.currentTimeMillis() > tokenExpiryMillis;

try {
  filter.doFilter(req, res, chain);
} catch (AuthenticationException e) {
  if ("AuthenticationToken expired".equals(e.getMessage())) {
    res.setHeader("WWW-Authenticate", "Negotiate"); res.sendError(401); // re-run SPNEGO
  }
}

When it happens

Trigger: doFilterSuper -> getToken parses a valid-type token whose validity time is in the past, e.g. a browser session left open longer than the configured authentication session lifetime.

Common situations: Long-lived browser tabs after the cookie TTL expired; very short druid.auth.authenticationSessionMillis; clocks skewed between issuing node and verifying node making valid tokens appear expired.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Invalid AuthenticationToken type
• AuthenticationToken ignored:
• Principal not defined in configuration
• Keytab not defined in configuration
• Keytab does not exist: %s

AI-assisted analysis of apache/druid@9b90983fd2 (2026-09-07). Data as JSON: /api/errors/6cd80fdff496f0d0. Report an issue: GitHub.