apache/druid · error · ForbiddenException

authResult.getErrorMessage()

Error message

authResult.getErrorMessage()

What it means

SamplerResource throws ForbiddenException (HTTP 403) with the authorizer's denial message when the caller is not authorized for the resource actions implied by the sampling request (typically WRITE/READ on the target datasource derived from the DataSchema). The filter-style check runs inside the POST handler before sampling executes. The message states which resource action failed.

Source

Thrown at indexing-service/src/main/java/org/apache/druid/indexing/overlord/sampler/SamplerResource.java:82

  @Consumes(MediaType.APPLICATION_JSON)
  @Produces(MediaType.APPLICATION_JSON)
  public SamplerResponse post(final SamplerSpec sampler, @Context final HttpServletRequest req)
  {
    Preconditions.checkNotNull(sampler, "Request body cannot be empty");
    Set<ResourceAction> resourceActions = new HashSet<>();
    resourceActions.add(STATE_RESOURCE_WRITE);
    if (authConfig.isEnableInputSourceSecurity()) {
      resourceActions.addAll(sampler.getInputSourceResources());
    }

    AuthorizationResult authResult = AuthorizationUtils.authorizeAllResourceActions(
        req,
        resourceActions,
        authorizerMapper
    );

    if (!authResult.allowAccessWithNoRestriction()) {
      throw new ForbiddenException(authResult.getErrorMessage());
    }
    return sampler.sample();
  }
}

View on GitHub (pinned to 9b90983fd2)

Solutions

  1. Grant the user's role the required ResourceActions (usually WRITE) on the target datasource
  2. Check the overlord log for the Access object message describing the exact denial
  3. Perform sampling as a user with sufficient privileges or change the dataSchema datasource to one you can access
  4. Fix the authorizer/authenticator mapping if the wrong authorizer handled the request

Example fix

// before: user role lacks 'wiki' WRITE
// after: add to role
// {"resource": {"name": "wiki", "type": "DATASOURCE"}, "actions": ["WRITE"]}
Defensive patterns

Strategy: try-catch

Try / catch

try { await samplerPost(payload); } catch (e) { if (e.status === 403) { requestDatasourceWriteGrant(payload.dataSchema.dataSource); } else throw e; }

Prevention

When it happens

Trigger: POST /druid/indexer/v1/sampler where the authenticated user's roles do not cover the datasource named in the request's dataSchema (or any datasource resourceActions computed from it).

Common situations: Using the web-console data loader as a user whose role lacks the datasource grants; sampling against a datasource the team has no access to; authorizer misconfiguration after datasource rename; anonymous user when anonymity is not permitted.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

AI-assisted analysis of apache/druid@9b90983fd2 (2026-09-07). Data as JSON: /api/errors/7f16e746c60fb671. Report an issue: GitHub.