apache/druid · error · ForbiddenException

authResult.getErrorMessage()

Error message

authResult.getErrorMessage()

What it means

SupervisorResourceFilter throws ForbiddenException (HTTP 403) with the authorization result's error message when the caller's access to the supervisor's datasources is not unrestricted. The filter performs an Authorizer check over all datasources of the supervisor spec and denies the request if any resource action fails. The message details which datasource/authorizer check failed.

Source

Thrown at indexing-service/src/main/java/org/apache/druid/indexing/overlord/http/security/SupervisorResourceFilter.java:107

    final SupervisorSpec spec = supervisorSpecOptional.get();
    Preconditions.checkArgument(
        spec.getDataSources() != null && spec.getDataSources().size() > 0,
        "No dataSources found to perform authorization checks"
    );

    Function<String, ResourceAction> resourceActionFunction = getAction(request) == Action.READ ?
                                                              AuthorizationUtils.DATASOURCE_READ_RA_GENERATOR :
                                                              AuthorizationUtils.DATASOURCE_WRITE_RA_GENERATOR;

    AuthorizationResult authResult = AuthorizationUtils.authorizeAllResourceActions(
        getReq(),
        Iterables.transform(spec.getDataSources(), resourceActionFunction),
        getAuthorizerMapper()
    );

    if (!authResult.allowAccessWithNoRestriction()) {
      throw new ForbiddenException(authResult.getErrorMessage());
    }

    return request;
  }
}

View on GitHub (pinned to 9b90983fd2)

Solutions

  1. Grant the user's role READ/WRITE ResourceActions on all datasources in the supervisor spec
  2. Check overlord logs for the underlying Access object message explaining the denial
  3. Verify the authorizerMapper configuration and that the correct authenticator/authorizer chain handled the request
  4. If the spec is wrong (too many datasources), update the supervisor spec to the intended set

Example fix

// before: user lacks access
// supervisor 'kafka-ds' writes to datasource 'wiki' but role only allows 'sales'
// after: update role in basic-security DB or JSON authorizer
// role 'user-role' -> resources: [{name: 'wiki', type: 'DATASOURCE', actions: ['READ','WRITE']},
//                               {name: 'sales', type: 'DATASOURCE', actions: ['READ','WRITE']}]
Defensive patterns

Strategy: try-catch

Try / catch

try { await callSupervisorApi(id); } catch (e) { if (e.status === 403) { requestDatasourceGrants(e.message); } else throw e; }

Prevention

When it happens

Trigger: A supervisor API request from a user whose authorizer role does not grant READ (or the required WRITE) on every datasource covered by the supervisor spec, so authResult.allowAccessWithNoRestriction() is false.

Common situations: User missing a role granting access to a newly added datasource in the supervisor spec; multi-datasource supervisor where only some datasources are permitted; misconfigured authorizer (e.g. default role not allowing the datasource); externalField/identity changes after SSO rotation.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

AI-assisted analysis of apache/druid@9b90983fd2 (2026-09-07). Data as JSON: /api/errors/f8b0fe35d104fa5b. Report an issue: GitHub.