apache/druid · error · IllegalStateException

Basic authentication credentials are configured but TLS is…

Error message

Basic authentication credentials are configured but TLS is not enabled. This would transmit credentials in cleartext over the network. Either configure TLS (connection.sslClientConfig.trustStorePath) or explicitly allow insecure transmission by setting auth.allowBasicAuthOverHttp=true (only use this for sidecar TLS termination scenarios).

What it means

Error "Basic authentication credentials are configured but TLS is not enabled. This would transmit credentials in cleartext over the network. Either configure TLS (connection.sslClientConfig.trustStorePath) or explicitly allow insecure transmission by setting auth.allowBasicAuthOverHttp=true (only use this for sidecar TLS termination scenarios)." thrown in apache/druid.

Solutions

1. Configure TLS via connection.sslClientConfig (e.g. trustStorePath) so basic-auth credentials are encrypted in transit.
2. If TLS is terminated by a sidecar in front of Consul, explicitly set auth.allowBasicAuthOverHttp=true.
3. Remove basicAuthUser/basicAuthPassword if credentials are not needed.

When it happens

Trigger: Thrown at extensions-contrib/consul-extensions/src/main/java/org/apache/druid/consul/discovery/ConsulClients.java:71 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.
• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of apache/druid@9b90983fd2 (2026-09-07). Data as JSON: /api/errors/46049592438e6d47. Report an issue: GitHub.

Appendix: source

Thrown at extensions-contrib/consul-extensions/src/main/java/org/apache/druid/consul/discovery/ConsulClients.java:71

  private ConsulClients()
  {
  }

  static ConsulClient create(ConsulDiscoveryConfig config)
  {
    ConsulDiscoveryConfig.ConnectionConfig connection = config.getConnection();
    ConsulDiscoveryConfig.AuthConfig auth = config.getAuth();

    ConsulSSLConfig sslConfig = connection.getSslClientConfig();
    String basicUser = auth.getBasicAuthUser();
    String basicPass = auth.getBasicAuthPassword();
    boolean tlsConfigured = sslConfig != null && sslConfig.getTrustStorePath() != null;

    // Validate basic auth over HTTP security requirements
    if (basicUser != null && basicPass != null && !tlsConfigured) {
      if (!auth.getAllowBasicAuthOverHttp()) {
        throw new IllegalStateException(
            "Basic authentication credentials are configured but TLS is not enabled. " +
            "This would transmit credentials in cleartext over the network. " +
            "Either configure TLS (connection.sslClientConfig.trustStorePath) or explicitly allow " +
            "insecure transmission by setting auth.allowBasicAuthOverHttp=true " +
            "(only use this for sidecar TLS termination scenarios)."
        );
      }
      LOGGER.warn(
          "Using Basic Auth to Consul over plain HTTP (host: %s, port: %d) with allowBasicAuthOverHttp=true. " +
          "Credentials will be transmitted in cleartext. " +
          "Only use this configuration with sidecar TLS termination or in secure network environments.",
          connection.getHost(),
          connection.getPort()
      );
    }

    if (tlsConfigured) {
      try {

View on GitHub (pinned to 9b90983fd2)