apache/druid · error · IllegalStateException

Could not delete user [%s] due to concurrent update contenti

Error message

Could not delete user [%s] due to concurrent update contention.

What it means

Thrown as IllegalStateException when deleteUserInternal fails to delete an authorizer user after exhausting all compare-and-swap retries. Persistent concurrent modification of the authorizer user map prevented the deletion from committing. Similar family to the authenticator-side contention errors.

Source

Thrown at extensions-core/druid-basic-security/src/main/java/org/apache/druid/security/basic/authorization/db/updater/CoordinatorBasicAuthorizerMetadataStorageUpdater.java:688

  }

  private void deleteUserInternal(String prefix, String userName)
  {
    int attempts = 0;
    while (attempts < numRetries) {
      if (deleteUserOnce(prefix, userName)) {
        return;
      } else {
        attempts++;
      }
      try {
        Thread.sleep(ThreadLocalRandom.current().nextLong(UPDATE_RETRY_DELAY));
      }
      catch (InterruptedException ie) {
        throw new RuntimeException(ie);
      }
    }
    throw new ISE("Could not delete user [%s] due to concurrent update contention.", userName);
  }

  private void createGroupMappingInternal(String prefix, BasicAuthorizerGroupMapping groupMapping)
  {
    int attempts = 0;
    while (attempts < numRetries) {
      if (createGroupMappingOnce(prefix, groupMapping)) {
        return;
      } else {
        attempts++;
      }
      try {
        Thread.sleep(ThreadLocalRandom.current().nextLong(UPDATE_RETRY_DELAY));
      }
      catch (InterruptedException ie) {
        throw new RuntimeException(ie);
      }
    }

View on GitHub (pinned to 9b90983fd2)

Solutions

Ensure only the elected coordinator writes (check leadership and any manually-triggered update endpoints)
Retry the deletion after backoff once concurrent updates settle
Check metadata store performance and health
Raise numRetries/UPDATE_RETRY_DELAY if contention is chronic in your deployment

Example fix

// before
client.deleteAuthorizerUser(authorizerName, userName); // ISE under contention
// after
try {
  client.deleteAuthorizerUser(authorizerName, userName);
} catch (IllegalStateException e) {
  Thread.sleep(retryBackoffMs);
  client.deleteAuthorizerUser(authorizerName, userName);
}

Defensive patterns

Strategy: retry

Validate before calling

// confirm the user exists before deleting
Response r = client.getAuthorizerUser(authorizerName, userName);
if (r.getStatus() != 200) { return; }

Try / catch

try {
  client.deleteAuthorizerUser(authorizerName, userName);
} catch (IllegalStateException e) {
  backoffAndRetry(() -> client.deleteAuthorizerUser(authorizerName, userName));
}

Prevention

Serialize authorizer user-management operations across tools
Verify single-coordinator leadership
Monitor and fix metadata store latency issues that prolong contention

When it happens

Trigger: Calling deleteUser on the authorizer storage updater while other writers keep changing the same authorizer user map, so every tryUpdateUserMap attempt fails across all retries.

Common situations: Concurrent admin operations or scripts deleting/modifying authorizer users; multiple coordinators acting as writers; metadata store slowdowns causing CAS retries to time out; retry storms during cluster upgrades.

Understand the failure class

Background: "This is a bug, please report it": internal invariant violations, unreachable panics, and SNH errors explained — this error's family across 47 libraries.

Related errors

AI-assisted analysis of apache/druid@9b90983fd2 (2026-09-07). Data as JSON: /api/errors/605519d4bb24c6a3. Report an issue: GitHub.