apache/druid · warning

Got an unexpected response status

Error message

Got an unexpected response status[%s] when loading group mappings.

What it means

tryFetchGroupMappingMapsFromCoordinator() logs this warning when the coordinator responds with a status other than 200 OK or 404 NOT_FOUND for the group-mappings endpoint. The method continues and attempts to parse the (likely empty or error) response body, which will typically fail downstream; the warning flags the unexpected status.

Solutions

1. Check coordinator logs for the underlying error that produced the non-200 status
2. Confirm internal authentication/authorizer config allows the authorizer cache manager to reach the coordinator
3. Retry after the coordinator stabilizes (the polling loop retries on the next interval)
4. Check whether the coordinator is the leader; group mapping fetch must go to the leader
5. Inspect any deserialization exception that follows for malformed response content

// verify coordinator is leader and reachable before fetching
HttpGet leaderCheck = new HttpGet("http://coordinator:8081/status/leader");

if (status != 200 && status != 404) {
  log.warn("group mapping fetch got status %s; will retry next poll", status);
  scheduleRetryWithBackoff();
}

When it happens

Trigger: The group-mappings fetch receives a non-200/non-404 HTTP status — e.g., 500 from a coordinator internal error, 401/403 from auth filters, 503 during coordinator leadership transitions.

Common situations: Coordinator not fully started or losing leadership; inter-process authentication (druid.auth) intercepting and rejecting the internal request; coordinator hitting an internal error building the group mapping map; proxy returning 502/504.

Related errors

• Action [ ] failed for worker [ ] with status ( )
• <authResult.getErrorMessage()>
• authResult.getErrorMessage()
• authResult.getErrorMessage()
• authResult.getErrorMessage()

AI-assisted analysis of apache/druid@9b90983fd2 (2026-09-07). Data as JSON: /api/errors/39a2810c5a20c5e2. Report an issue: GitHub.

Appendix: source

Thrown at extensions-core/druid-basic-security/src/main/java/org/apache/druid/security/basic/authorization/db/cache/CoordinatorPollingBasicAuthorizerCacheManager.java:444

        StringUtils.format("/druid-ext/basic-security/authorization/db/%s/cachedSerializedGroupMappingMap", prefix)
    );
    BytesFullResponseHolder responseHolder = coordinatorClient.request(
        req,
        new BytesFullResponseHandler()
    );

    final HttpResponseStatus status = responseHolder.getStatus();

    // cachedSerializedGroupMappingMap is a new endpoint introduced in Druid 0.17.0. For backwards compatibility, if we
    // get a 404 from the coordinator we stop retrying. This can happen during a rolling upgrade when a process
    // running 0.17.0+ tries to access this endpoint on an older coordinator.
    if (HttpResponseStatus.NOT_FOUND.equals(status)) {
      LOG.warn("cachedSerializedGroupMappingMap is not available from the coordinator, skipping fetch of group mappings for now.");
      return null;
    }

    if (!HttpResponseStatus.OK.equals(status)) {
      LOG.warn("Got an unexpected response status[%s] when loading group mappings.", status);
    }

    byte[] groupRoleMapBytes = responseHolder.getContent();

    GroupMappingAndRoleMap groupMappingAndRoleMap = objectMapper.readValue(
        groupRoleMapBytes,
        BasicAuthUtils.AUTHORIZER_GROUP_MAPPING_AND_ROLE_MAP_TYPE_REFERENCE
    );
    if (groupMappingAndRoleMap != null && commonCacheConfig.getCacheDirectory() != null) {
      writeGroupMappingMapToDisk(prefix, groupRoleMapBytes);
    }
    return groupMappingAndRoleMap;
  }

  private void initUserMaps()
  {
    AuthorizerMapper authorizerMapper = injector.getInstance(AuthorizerMapper.class);

View on GitHub (pinned to 9b90983fd2)