apache/druid · error · IllegalArgumentException

OPA response field [result] must be a JSON boolean

Error message

OPA response field [result] must be a JSON boolean

What it means

Thrown by the OpaResponse JSON creator when the 'result' field of an OPA authorization response is missing or is not a JSON boolean. OPA's /v1/data endpoint should return {"result": true/false} for a boolean policy; a non-boolean result means the policy returned an object, string, or no result, so the Druid authorizer cannot interpret the decision and treats the response as malformed.

Solutions

1. Check the OPA policy: its default rule must evaluate to a boolean (e.g. `default allow = false`, `allow { ... }`).
2. Test the policy directly with `opa eval` or a curl to the OPA /v1/data endpoint to confirm 'result' is a boolean.
3. If the policy intentionally returns non-boolean results, change it or use a wrapper that projects a boolean into 'result'.
4. Verify the OPA URL/request body configured in the Druid opa authorizer points at the intended policy package and path.

When it happens

Trigger: Thrown at extensions-contrib/druid-opa-authorizer/src/main/java/org/apache/druid/security/opa/opatypes/OpaResponse.java:34 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of apache/druid@9b90983fd2 (2026-09-07). Data as JSON: /api/errors/d7a0ad7232dfaafb. Report an issue: GitHub.

Appendix: source

Thrown at extensions-contrib/druid-opa-authorizer/src/main/java/org/apache/druid/security/opa/opatypes/OpaResponse.java:34

 * specific language governing permissions and limitations
 * under the License.
 */

package org.apache.druid.security.opa.opatypes;

import com.fasterxml.jackson.annotation.JsonCreator;
import com.fasterxml.jackson.annotation.JsonProperty;
import com.fasterxml.jackson.databind.JsonNode;

public class OpaResponse
{
  private final boolean result;

  @JsonCreator
  public OpaResponse(@JsonProperty("result") JsonNode result)
  {
    if (result == null || !result.isBoolean()) {
      throw new IllegalArgumentException("OPA response field [result] must be a JSON boolean");
    }
    this.result = result.booleanValue();
  }

  @JsonProperty
  public boolean isResult()
  {
    return result;
  }
}

View on GitHub (pinned to 9b90983fd2)