apache/druid · error · BasicSecurityDBResourceException

Invalid permission, resource name regex[%s] does not compile

Error message

Invalid permission, resource name regex[%s] does not compile.

What it means

When a BasicAuthorizerPermission is built from a ResourceAction (the internal representation path), the resource name is compiled as a Java regex to produce resourceNamePattern. If the stored resource name contains invalid regex syntax (e.g. an unbalanced '[' or dangling '*'), Pattern.compile throws PatternSyntaxException and the permission is rejected with BasicSecurityDBResourceException — the persisted permission data itself is malformed.

Source

Thrown at extensions-core/druid-basic-security/src/main/java/org/apache/druid/security/basic/authorization/entity/BasicAuthorizerPermission.java:56

  public BasicAuthorizerPermission(
      @JsonProperty("resourceAction") ResourceAction resourceAction,
      @JsonProperty("resourceNamePattern") Pattern resourceNamePattern
  )
  {
    this.resourceAction = resourceAction;
    this.resourceNamePattern = resourceNamePattern;
  }

  private BasicAuthorizerPermission(
      ResourceAction resourceAction
  )
  {
    this.resourceAction = resourceAction;
    try {
      this.resourceNamePattern = Pattern.compile(resourceAction.getResource().getName());
    }
    catch (PatternSyntaxException pse) {
      throw new BasicSecurityDBResourceException(
          pse,
          "Invalid permission, resource name regex[%s] does not compile.",
          resourceAction.getResource().getName()
      );
    }
  }

  @JsonProperty
  public ResourceAction getResourceAction()
  {
    return resourceAction;
  }

  @JsonProperty
  public Pattern getResourceNamePattern()
  {
    return resourceNamePattern;
  }

View on GitHub (pinned to 9b90983fd2)

Solutions

1. Locate the role permission with the invalid resource-name regex (it may have been written directly to the metadata store or via an older API)
2. Fix or remove the bad permission and re-save it with a valid regex; escape literal metacharacters (e.g. use \. for dots)
3. Restore a consistent authorizer state from backup if many permissions are corrupted

When it happens

Trigger: Thrown at extensions-core/druid-basic-security/src/main/java/org/apache/druid/security/basic/authorization/entity/BasicAuthorizerPermission.java:56 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of apache/druid@9b90983fd2 (2026-09-07). Data as JSON: /api/errors/60c21a27a7ff1b7a. Report an issue: GitHub.