apache/druid · error · UnsupportedOperationException

JDBC Kerberos auth not supported yet

Error message

JDBC Kerberos auth not supported yet

What it means

KerberosAuthenticator.authenticateJDBCContext is explicitly unimplemented: kerberos authentication for JDBC connections (avatica context-based auth) is not supported, so the method unconditionally throws UnsupportedOperationException.

Source

Thrown at extensions-core/druid-kerberos/src/main/java/org/apache/druid/security/kerberos/KerberosAuthenticator.java:415

    return "/*";
  }

  @Override
  public EnumSet<DispatcherType> getDispatcherType()
  {
    return null;
  }

  @Override
  public String getAuthChallengeHeader()
  {
    return "Negotiate";
  }

  @Override
  public AuthenticationResult authenticateJDBCContext(Map<String, Object> context)
  {
    throw new UnsupportedOperationException("JDBC Kerberos auth not supported yet");
  }

  @Override
  public void decorateProxyRequest(
      HttpServletRequest clientRequest,
      HttpServletResponse proxyResponse,
      Request proxyRequest
  )
  {
    Object cookieToken = clientRequest.getAttribute(SIGNED_TOKEN_ATTRIBUTE);
    if (cookieToken != null && cookieToken instanceof String) {
      log.debug("Found cookie token will attache it to proxyRequest as cookie");
      String authResult = (String) cookieToken;
      proxyRequest.cookie(HttpCookie.from(SIGNED_TOKEN_ATTRIBUTE, authResult));
    }
  }

  /**

View on GitHub (pinned to 9b90983fd2)

Solutions

1. Do not use JDBC with kerberos auth; use HTTP-level (SPNEGO) authentication instead
2. Authenticate over HTTP and rely on that path, or configure a different authenticator chain for JDBC-facing endpoints
3. Use kerberized delegation only where supported (e.g.HttpClient SPNEGO) rather than JDBC context

Example fix

// before
Map<String,Object> ctx = Map.of("user", "kerbUser"); // triggers authenticateJDBCContext
connection.setClientInfo(...); // auth attempt via JDBC context
// after
// authenticate over HTTP with SPNEGO, or use basic auth authenticator for JDBC endpoints

if (authenticator instanceof KerberosAuthenticator) {
  throw new UnsupportedOperationException("Use HTTP/SPNEGO auth; JDBC kerberos auth is not supported");
}

try {
  result = authenticator.authenticateJDBCContext(context);
} catch (UnsupportedOperationException e) {
  // fall back to HTTP authentication path
}

When it happens

Trigger: Any code path calling authenticateJDBCContext(Map) — i.e. a JDBC client presenting credentials through the JDBC context map to a kerberos-protected cluster.

Common situations: Attempting kerberos-secured JDBC connections to Druid from tools (JDBC clients, BI tools) instead of HTTP; assuming SPNEGO browser auth also covers JDBC.

Related errors

• Principal not defined in configuration
• Keytab not defined in configuration
• Keytab does not exist: %s
• Principals do not exist in the keytab
• Failed to authenticate user principal [%s] with keytab [%s]

AI-assisted analysis of apache/druid@9b90983fd2 (2026-09-07). Data as JSON: /api/errors/2d2af9f1cfd36f84. Report an issue: GitHub.