apache/druid · warning

AuthenticationToken ignored:

Error message

AuthenticationToken ignored: 

What it means

KerberosAuthenticator.doFilterSuper() attempts to extract an AuthenticationToken from the incoming HTTP request via getToken(). If that throws AuthenticationException (e.g. a malformed or invalid auth token/Authorization header), the token is discarded, this warning is logged with the exception message, and the request proceeds unauthenticated — usually answered with a 401 challenge.

Source

Thrown at extensions-core/druid-kerberos/src/main/java/org/apache/druid/security/kerberos/KerberosAuthenticator.java:257

       * can check the request.
       */
      private void doFilterSuper(ServletRequest request, ServletResponse response, FilterChain filterChain)
          throws IOException, ServletException
      {
        boolean unauthorizedResponse = true;
        int errCode = HttpServletResponse.SC_UNAUTHORIZED;
        AuthenticationException authenticationEx = null;
        HttpServletRequest httpRequest = (HttpServletRequest) request;
        HttpServletResponse httpResponse = (HttpServletResponse) response;
        boolean isHttps = "https".equals(httpRequest.getScheme());
        try {
          boolean newToken = false;
          AuthenticationToken token;
          try {
            token = getToken(httpRequest);
          }
          catch (AuthenticationException ex) {
            log.warn("AuthenticationToken ignored: " + ex.getMessage());
            // will be sent back in a 401 unless filter authenticates
            authenticationEx = ex;
            token = null;
          }
          if (getAuthenticationHandler().managementOperation(token, httpRequest, httpResponse)) {
            if (token == null) {
              if (log.isDebugEnabled()) {
                log.debug("Request [{%s}] triggering authentication", getRequestURL(httpRequest));
              }
              token = getAuthenticationHandler().authenticate(httpRequest, httpResponse);
              if (token != null && token.getExpires() != 0 &&
                  token != AuthenticationToken.ANONYMOUS) {
                token.setExpires(System.currentTimeMillis() + getValidity() * 1000);
              }
              newToken = true;
            }
            if (token != null) {
              unauthorizedResponse = false;

View on GitHub (pinned to 9b90983fd2)

Solutions

1. Re-authenticate: clear cached credentials (e.g. re-run kinit, clear browser cookies for the host) so a fresh token is sent.
2. Read the appended exception message in the log to identify the exact parse/validation failure.
3. Verify the client uses the expected scheme (Negotiate/SPNEGO for Kerberos) rather than an unsupported one.
4. If seen on every request, check server clock skew against the KDC — expired tokens cause repeated rejection.

try { authenticate(request); }
catch (AuthenticationException e) {
  LOG.warn("token ignored: {}", e.getMessage());
  response.setHeader("WWW-Authenticate", "Negotiate");
  response.sendError(401); // client re-authenticates with fresh token
}

When it happens

Trigger: A request carries an Authorization header (Negotiate/Bearer/cookie token) that getToken() cannot parse or validate: corrupted base64, invalid Kerberos SPNEGO blob, expired cookie token, or unsupported auth scheme.

Common situations: Clients sending stale cached Kerberos tickets; curl/browser replaying an expired auth cookie; middleboxes mangling the Authorization header; misconfigured clients sending plain Basic auth where Negotiate is required.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Invalid AuthenticationToken type
• Failed to login as [%s]
• Authentication exception:
• Principal not defined in configuration
• Principals do not exist in the keytab

AI-assisted analysis of apache/druid@9b90983fd2 (2026-09-07). Data as JSON: /api/errors/183fbab0421b6e79. Report an issue: GitHub.