apache/druid · warning

No profiles found after OIDC auth.

Error message

No profiles found after OIDC auth.

What it means

Pac4jFilter.doFilter() completes OIDC (OpenID Connect) authentication but the resulting user profile list is empty — no profiles were recovered from the OIDC session/token. The filter logs this warning and deliberately does not continue the filter chain, letting pac4j handle the authentication failure (typically a redirect to the identity provider or an error response).

Solutions

1. Check pac4j/OIDC client configuration: correct client id/secret, discovery URI, and requested scopes (openid, profile, email).
2. Verify cookies survive the redirect: correct callback URL scheme/host, HTTPS in front, no cookie-stripping proxy or SameSite/Lax misconfig.
3. Confirm the IdP actually returns the expected claims by inspecting the token (decode the ID token payload).
4. If running multiple Druid nodes, ensure session/user-profile storage works across nodes (shared cookie/session store configuration).

Example fix

// before
// scopes: openid            -> no profile claims, empty UserProfile
// after
// scopes: openid profile email -> IdP returns sub/name/email, UserProfile populated

// decode and verify the ID token carries expected claims
const payload = JSON.parse(atob(idToken.split('.')[1]));
if (!payload.sub) throw new Error("IdP returned no subject claim");

When it happens

Trigger: After the OIDC callback, the session/cookie store returns no UserProfile (profileManager.getProfiles() empty) while a uid could not be derived: IdP did not return expected claims, session cookie lost between redirect legs, or pac4j client misconfiguration.

Common situations: Session cookie dropped due to HTTPS/hostname mismatch or SameSite issues; IdP scopes not configured to include identifying claims (e.g. missing email/profile scope); clock skew making the ID token invalid; load-balanced Druid nodes without shared session state.

Related errors

• Cookie too big, it might not be properly set
• Authentication exception:
• AuthenticationToken ignored:
• Either set 'key' or 'sharedAccessStorageToken' or…
• Failed to authenticate to schema registry for Avro schema id

AI-assisted analysis of apache/druid@9b90983fd2 (2026-09-07). Data as JSON: /api/errors/d60247b88656918c. Report an issue: GitHub.

Appendix: source

Thrown at extensions-core/druid-pac4j/src/main/java/org/apache/druid/security/pac4j/Pac4jFilter.java:119

    } else {
      DefaultSecurityLogic securityLogic = new DefaultSecurityLogic();
      try {
        securityLogic.perform(
            context,
            sessionStore,
            pac4jConfig,
            (ctx, session, profiles, parameters) -> {
              try {
                // Extract user ID from pac4j profiles and create AuthenticationResult
                if (profiles != null && !profiles.isEmpty()) {
                  String uid = profiles.iterator().next().getId();
                  if (uid != null) {
                    AuthenticationResult authenticationResult = new AuthenticationResult(uid, authorizerName, name, null);
                    servletRequest.setAttribute(AuthConfig.DRUID_AUTHENTICATION_RESULT, authenticationResult);
                    filterChain.doFilter(servletRequest, servletResponse);
                  }
                } else {
                  LOGGER.warn("No profiles found after OIDC auth.");
                  // Don't continue the filter chain - let pac4j handle the authentication failure
                }
              }
              catch (IOException | ServletException e) {
                throw new RuntimeException(e);
              }
              return null;
            },
            JEEHttpActionAdapter.INSTANCE,
            null,
            "none",  // Use "none" instead of authorizerName to avoid CSRF issues
            null
        );
      }
      catch (HttpAction e) {
        JEEHttpActionAdapter.INSTANCE.adapt(e, context);
      }
    }

View on GitHub (pinned to 9b90983fd2)