apache/druid · error · IllegalStateException

No authorizer found with name

Error message

No authorizer found with name: [%s].

What it means

AuthorizationUtils.authorizeAllResourceActions looks up the Authorizer named by AuthenticationResult.getAuthorizerName() from the AuthorizerMapper; if none is registered it throws IllegalArgumentException-free ISE "No authorizer found with name: [...]". This indicates the authentication result references an authorizer that does not exist in the runtime configuration.

Solutions

1. Add the referenced authorizer to druid.auth.authorizers and define it under druid.auth.authorizers.<name>.
2. Fix the authenticator's authorizerName property to match an existing authorizer.
3. Restart the service after correcting the runtime properties.
4. Check cluster-wide config consistency so all nodes register the same authorizers.

Example fix

// before
// druid.auth.authenticator.basic.authorizerName = myAuthr // typo
// after
// druid.auth.authenticator.basic.authorizerName = myAuthorizer
// druid.auth.authorizers = ["myAuthorizer"]

if (authorizerMapper.getAuthorizer(authenticationResult.getAuthorizerName()) == null) {
  throw new ISE("Configured authorizer '%s' is not registered; check druid.auth.authorizers", authenticationResult.getAuthorizerName());
}

try { AuthorizationUtils.authorizeAllResourceActions(req, resourceActions, authorizerMapper); }
catch (ISE e) { if (e.getMessage().startsWith("No authorizer found")) { alertConfigIssue(e); } else { throw e; } }

When it happens

Trigger: An authenticator (e.g. Basic/Kerberos) sets an authorizerName in its AuthenticationResult that is not defined under druid.auth.authorizers, or the authorizer name is misspelled/misconfigured.

Common situations: Config typo in authenticator's authorizerName; authorizer removed from druid.auth.authorizers but authenticator still references it; rolling upgrade where configs differ across the cluster.

Understand the failure class

Background: 'Could not be found', 'does not exist', 'not found in database': the resource-not-found family when an ID, slug, key, or URI lookup comes back empty — this error's family across 20 libraries.

Related errors

• Access-Check-Result
• Access-Check-Result
• At least one of baseDir or files should be specified
• authResult.getErrorMessage()
• <authResult.getErrorMessage()>

AI-assisted analysis of apache/druid@9b90983fd2 (2026-09-07). Data as JSON: /api/errors/cd40adb62d4231c3. Report an issue: GitHub.

Appendix: source

Thrown at server/src/main/java/org/apache/druid/server/security/AuthorizationUtils.java:229

   * <p>
   * If one of the resource-actions denys access, returns deny access immediately.
   *
   * @param authenticationResult Authentication result representing identity of requester
   * @param resourceActions      An Iterable of resource-actions to authorize
   * @return AuthorizationResult containing allow/deny access to the resource actions, along with policy restrictions.
   */
  public static AuthorizationResult authorizeAllResourceActions(
      final AuthenticationResult authenticationResult,
      final Iterable<ResourceAction> resourceActions,
      final AuthorizerMapper authorizerMapper
  )
  {
    final Authorizer authorizer = authorizerMapper.getAuthorizer(authenticationResult.getAuthorizerName());
    if (authorizer == null) {
      final String msg =
          StringUtils.format("No authorizer found with name: [%s].", authenticationResult.getAuthorizerName());
      emitAuthMetric(authorizerMapper.getServiceEmitter(), authenticationResult, null, METRIC_EXCEPTION, null);
      throw new ISE(msg);
    }

    // this method returns on first failure, so only successful Access results are kept in the cache
    final Set<ResourceAction> resultCache = new HashSet<>();
    final Map<String, Optional<Policy>> policyFilters = new HashMap<>();

    for (ResourceAction resourceAction : resourceActions) {
      if (resultCache.contains(resourceAction)) {
        continue;
      }
      final Access access = authorizer.authorize(
          authenticationResult,
          resourceAction.getResource(),
          resourceAction.getAction()
      );
      if (!access.isAllowed()) {
        emitAuthMetric(authorizerMapper.getServiceEmitter(), authenticationResult, resourceAction, METRIC_FORBIDDEN, access.getMessage());
        return AuthorizationResult.deny(access.getMessage());

View on GitHub (pinned to 9b90983fd2)