apache/druid · error · BasicSecurityDBResourceException

Group mapping [ ] does not exist.

Error message

Group mapping [%s] does not exist.

What it means

getGroupMappingSimple() deserializes the authorizer's persisted group-mapping map from the metadata store and does a plain map lookup by name. A null result — the requested groupMappingName simply does not exist for the given authorizer — is converted into a BasicSecurityDBResourceException. The faulty input is the group mapping name in the coordinator API request, or the authorizer name addressing the wrong store.

Solutions

1. Verify the group mapping name and authorizer name used in the API call (e.g. GET /druid-ext/basic-security/authorization/<authorizer>/groupMappings/<name>)
2. List the existing group mappings to find the correct name before retrying
3. Create the missing group mapping via the coordinator API if it was never provisioned, or restore the authorizer metadata store from backup

When it happens

Trigger: Thrown at extensions-core/druid-basic-security/src/main/java/org/apache/druid/security/basic/authorization/endpoint/CoordinatorBasicAuthorizerResourceHandler.java:560 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of apache/druid@9b90983fd2 (2026-09-07). Data as JSON: /api/errors/9b2694a100425d79. Report an issue: GitHub.

Appendix: source

Thrown at extensions-core/druid-basic-security/src/main/java/org/apache/druid/security/basic/authorization/endpoint/CoordinatorBasicAuthorizerResourceHandler.java:560

        log.error("User [%s] had role [%s], but role object was not found.", user.getName(), roleName);
      } else {
        roles.add(role);
      }
    }
    return roles;
  }

  private Response getGroupMappingSimple(String authorizerName, String groupMappingName)
  {
    Map<String, BasicAuthorizerGroupMapping> groupMappings = BasicAuthUtils.deserializeAuthorizerGroupMappingMap(
        objectMapper,
        storageUpdater.getCurrentGroupMappingMapBytes(authorizerName)
    );

    try {
      BasicAuthorizerGroupMapping groupMapping = groupMappings.get(groupMappingName);
      if (groupMapping == null) {
        throw new BasicSecurityDBResourceException("Group mapping [%s] does not exist.", groupMappingName);
      }
      return Response.ok(groupMapping).build();
    }
    catch (BasicSecurityDBResourceException e) {
      return makeResponseForBasicSecurityDBResourceException(e);
    }
  }

  private Response getGroupMappingFull(String authorizerName, String groupMappingName)
  {
    Map<String, BasicAuthorizerGroupMapping> groupMappings = BasicAuthUtils.deserializeAuthorizerGroupMappingMap(
        objectMapper,
        storageUpdater.getCurrentGroupMappingMapBytes(authorizerName)
    );

    try {
      BasicAuthorizerGroupMapping groupMapping = groupMappings.get(groupMappingName);
      if (groupMapping == null) {

View on GitHub (pinned to 9b90983fd2)