apache/druid · error · BasicSecurityDBResourceException

Role [ ] does not exist.

Error message

Role [%s] does not exist.

What it means

getRoleSimple() deserializes the persisted role map for the authorizer and looks up roleName. When the map contains no entry for that name (the role was deleted or never created, or the authorizer name points at a different store), the handler throws BasicSecurityDBResourceException. The faulty input is the role name (or authorizer name) supplied to the API.

Solutions

1. Confirm the role name and authorizer name in the request (GET .../roles/<roleName>)
2. List existing roles to check the exact spelling/case of the role
3. Recreate the role via the coordinator API if it was removed, or restore the authorizer DB state from backup

When it happens

Trigger: Thrown at extensions-core/druid-basic-security/src/main/java/org/apache/druid/security/basic/authorization/endpoint/CoordinatorBasicAuthorizerResourceHandler.java:615 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of apache/druid@9b90983fd2 (2026-09-07). Data as JSON: /api/errors/19072c2f273e228b. Report an issue: GitHub.

Appendix: source

Thrown at extensions-core/druid-basic-security/src/main/java/org/apache/druid/security/basic/authorization/endpoint/CoordinatorBasicAuthorizerResourceHandler.java:615

      BasicAuthorizerGroupMappingFull fullGroup = new BasicAuthorizerGroupMappingFull(groupMapping.getName(), groupMapping.getGroupPattern(), roles);
      return Response.ok(fullGroup).build();
    }
    catch (BasicSecurityDBResourceException e) {
      return makeResponseForBasicSecurityDBResourceException(e);
    }
  }

  private Response getRoleSimple(String authorizerName, String roleName, boolean simplifyPermissions)
  {
    Map<String, BasicAuthorizerRole> roleMap = BasicAuthUtils.deserializeAuthorizerRoleMap(
        objectMapper,
        storageUpdater.getCurrentRoleMapBytes(authorizerName)
    );

    try {
      BasicAuthorizerRole role = roleMap.get(roleName);
      if (role == null) {
        throw new BasicSecurityDBResourceException("Role [%s] does not exist.", roleName);
      }

      if (simplifyPermissions) {
        return Response.ok(new BasicAuthorizerRoleSimplifiedPermissions(role, null)).build();
      } else {
        return Response.ok(role).build();
      }
    }
    catch (BasicSecurityDBResourceException e) {
      return makeResponseForBasicSecurityDBResourceException(e);
    }
  }

  private Response getRoleFull(String authorizerName, String roleName, boolean simplifyPermissions)
  {
    Map<String, BasicAuthorizerRole> roleMap = BasicAuthUtils.deserializeAuthorizerRoleMap(
        objectMapper,
        storageUpdater.getCurrentRoleMapBytes(authorizerName)

View on GitHub (pinned to 9b90983fd2)