apache/druid · error · AuthenticationException

Invalid AuthenticationToken type

Error message

Invalid AuthenticationToken type

What it means

In KerberosAuthenticator.getToken, the cookie-derived AuthenticationToken parsed from the request is compared against the handler's declared type. A mismatch means the stored token was issued by a different authentication scheme, so it is rejected with AuthenticationException.

Source

Thrown at extensions-core/druid-kerberos/src/main/java/org/apache/druid/security/kerberos/KerberosAuthenticator.java:204

        Cookie[] cookies = request.getCookies();
        if (cookies != null) {
          for (Cookie cookie : cookies) {
            if (cookie.getName().equals(AuthenticatedURL.AUTH_COOKIE)) {
              tokenStr = cookie.getValue();
              try {
                tokenStr = mySigner.verifyAndExtract(tokenStr);
              }
              catch (SignerException ex) {
                throw new AuthenticationException(ex);
              }
              break;
            }
          }
        }
        if (tokenStr != null) {
          token = AuthenticationToken.parse(tokenStr);
          if (!token.getType().equals(getAuthenticationHandler().getType())) {
            throw new AuthenticationException("Invalid AuthenticationToken type");
          }
          if (token.isExpired()) {
            throw new AuthenticationException("AuthenticationToken expired");
          }
        }
        return token;
      }

      @Override
      public void doFilter(ServletRequest request, ServletResponse response, FilterChain filterChain)
          throws IOException, ServletException
      {
        // If there's already an auth result, then we have authenticated already, skip this.
        if (request.getAttribute(AuthConfig.DRUID_AUTHENTICATION_RESULT) != null) {
          filterChain.doFilter(request, response);
          return;
        }

View on GitHub (pinned to 9b90983fd2)

Solutions

  1. Clear stale authentication cookies in the client (or the 'druid_' auth cookie) and re-authenticate
  2. Ensure all nodes in the cluster use the same authenticator type configuration
  3. After an authenticator change, restart/roll the cluster so tokens are reissued under the new type
Defensive patterns

Strategy: try-catch

Validate before calling

// client-side: drop cookies from previous authenticators before reconnect
// e.g. new CookieManager().getCookieStore().removeAll();

Try / catch

try {
  filter.doFilter(req, res, chain);
} catch (AuthenticationException e) {
  if ("Invalid AuthenticationToken type".equals(e.getMessage())) {
    res.setHeader("WWW-Authenticate", "Negotiate"); res.sendError(401); // force renegotiation
  }
}

Prevention

When it happens

Trigger: doFilterSuper -> getToken parses a token string from the request/cookie whose getType() differs from getAuthenticationHandler().getType() (e.g. a token cookie left over from a previous, different authenticator).

Common situations: Switching authenticator chains (e.g. from basic to kerberos) while browsers retain old auth cookies; load-balanced cluster with inconsistent auth configurations across nodes; upgraded cluster where the token type/serializer changed.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

AI-assisted analysis of apache/druid@9b90983fd2 (2026-09-07). Data as JSON: /api/errors/e0bf13260ff3a87d. Report an issue: GitHub.