apache/druid · error · IllegalStateException

Could not unassign role

Error message

Could not unassign role [%s] from group mapping [%s] due to concurrent update contention.

What it means

Unassigning a role from an authorization group mapping failed after exhausting numRetries compare-and-swap attempts because concurrent writers kept updating the metadata maps first. Each retry re-reads the current map and re-applies the removal; persistent contention throws this ISE with the role and group mapping names. It reflects metadata-storage contention rather than a data problem.

Solutions

1. Retry unassignGroupMappingRole after a short backoff.
2. Enforce single-writer semantics for basic-security metadata.
3. Serialize group mapping cleanup operations.
4. Raise numRetries to tolerate concurrent update bursts.
5. Verify metadata storage health/latency.

Example fix

// before
client.unassignGroupMappingRole(prefix, groupMappingName, roleName);
// after
for (int i = 0; i < 5; i++) {
  try { client.unassignGroupMappingRole(prefix, groupMappingName, roleName); return; }
  catch (IJSE e) { Thread.sleep(1000); }
}

// Skip if the mapping lacks the role
BasicAuthorizerGroupMapping gm = BasicAuthUtils.deserializeAuthorizerGroupMappingMap(
    mapper, getCurrentGroupMappingMapBytes(prefix)).get(groupMappingName);
if (gm == null || !gm.getRoles().contains(roleName)) return;

try {
  updater.unassignGroupMappingRole(prefix, groupMappingName, roleName);
} catch (IJSE e) {
  await.atMost(Duration.ofSeconds(10)).untilAsserted(
      () -> updater.unassignGroupMappingRole(prefix, groupMappingName, roleName));
}

When it happens

Trigger: Calling unassignGroupMappingRole while other clients continuously mutate the same authorizer prefix's metadata so the CAS never succeeds within the retry budget.

Common situations: Parallel cleanup jobs editing group mappings; simultaneous unassignment and role/permission changes; contention between admin UI and API calls.

Related errors

• Could not assign role
• Could not assign role
• Could not create group mapping
• Could not create role
• Could not delete group mapping

AI-assisted analysis of apache/druid@9b90983fd2 (2026-09-07). Data as JSON: /api/errors/2864cc4f8072284e. Report an issue: GitHub.

Appendix: source

Thrown at extensions-core/druid-basic-security/src/main/java/org/apache/druid/security/basic/authorization/db/updater/CoordinatorBasicAuthorizerMetadataStorageUpdater.java:843

  }

  private void unassignGroupMappingRoleInternal(String prefix, String groupMappingName, String roleName)
  {
    int attempts = 0;
    while (attempts < numRetries) {
      if (unassignGroupMappingRoleOnce(prefix, groupMappingName, roleName)) {
        return;
      } else {
        attempts++;
      }
      try {
        Thread.sleep(ThreadLocalRandom.current().nextLong(UPDATE_RETRY_DELAY));
      }
      catch (InterruptedException ie) {
        throw new RuntimeException(ie);
      }
    }
    throw new ISE("Could not unassign role [%s] from group mapping [%s] due to concurrent update contention.", roleName,
                  groupMappingName
    );
  }

  private void setPermissionsInternal(String prefix, String roleName, List<ResourceAction> permissions)
  {
    int attempts = 0;
    while (attempts < numRetries) {
      if (setPermissionsOnce(prefix, roleName, permissions)) {
        return;
      } else {
        attempts++;
      }
      try {
        Thread.sleep(ThreadLocalRandom.current().nextLong(UPDATE_RETRY_DELAY));
      }
      catch (InterruptedException ie) {
        throw new RuntimeException(ie);

View on GitHub (pinned to 9b90983fd2)