apache/druid · error · IllegalArgumentException

Invalid opaUri

Error message

Invalid opaUri: %s

What it means

Authorizer constructor guard: the configured opaUri cannot be parsed as a URI (bad syntax, stray characters, or missing scheme), so authorizer creation fails with this message carrying the parse exception as cause.

Solutions

1. Set opaUri to a valid absolute URI, e.g. http://opa-host:8181/v1/data/druid/authz/allow.
2. Check for spaces, illegal characters, or a missing scheme in the configured value.

When it happens

Trigger: Thrown at extensions-contrib/druid-opa-authorizer/src/main/java/org/apache/druid/security/opa/OpaAuthorizer.java:94 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of apache/druid@9b90983fd2 (2026-09-07). Data as JSON: /api/errors/84b6b103ea512550. Report an issue: GitHub.

Appendix: source

Thrown at extensions-contrib/druid-opa-authorizer/src/main/java/org/apache/druid/security/opa/OpaAuthorizer.java:94

        timeoutMs,
        HttpClient.newBuilder()
                  .connectTimeout(Duration.ofMillis(timeoutMs != null ? timeoutMs : DEFAULT_TIMEOUT_MS))
                  .build()
    );
  }

  public OpaAuthorizer(
      String name,
      String opaUri,
      Long timeoutMs,
      HttpClient httpClient
  )
  {
    try {
      this.opaUri = new URI(opaUri);
    }
    catch (Exception e) {
      throw new IllegalArgumentException("Invalid opaUri: " + opaUri, e);
    }
    this.objectMapper =
        new ObjectMapper()
            // https://github.com/stackabletech/druid-opa-authorizer/issues/72
            // OPA server can send other fields, such as `decision_id` when enabling decision logs
            // We could add all the fields we *currently* know, but it's more future-proof to ignore
            // any unknown fields.
            .configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false);

    this.timeout = Duration.ofMillis(timeoutMs != null ? timeoutMs : DEFAULT_TIMEOUT_MS);
    this.httpClient = httpClient;
    // name is required for @JsonCreator but unused in this implementation
    LOG.debug("Created OpaAuthorizer [%s]", name);
  }

  @Override
  public Access authorize(
      AuthenticationResult authenticationResult,

View on GitHub (pinned to 9b90983fd2)