apache/druid · error · UOE

Task type [%s], does not support input source based security

Error message

Task type [%s], does not support input source based security

What it means

Task.getInputSourceResources is the default hook a task type implements to declare the input-source resources it needs for input-source-based security checks. The base Task interface does not support this model, so the default implementation throws UOE; only task types that explicitly override it (e.g. batch/ingestion tasks with declared inputSources) can be authorization-checked this way.

Source

Thrown at indexing-service/src/main/java/org/apache/druid/indexing/common/task/Task.java:176

  String getNodeType();

  /**
   * Returns the datasource this task operates on. Each task can operate on only one datasource.
   */
  String getDataSource();

  /**
   * @return The types of {@link org.apache.druid.data.input.InputSource} that the task uses. Empty set is returned if
   * the task does not use any. Users can be given permission to access particular types of
   * input sources but not others, using the
   * {@link org.apache.druid.server.security.AuthConfig#enableInputSourceSecurity} config.
   * @throws UnsupportedOperationException if the given task type does not suppoert input source based security
   */
  @JsonIgnore
  @Nonnull
  default Set<ResourceAction> getInputSourceResources() throws UOE
  {
    throw new UOE(StringUtils.format(
        "Task type [%s], does not support input source based security",
        getType()
    ));
  }

  /**
   * Returns query runners for this task. If this task is not meant to answer queries over its datasource, this method
   * should return null.
   *
   * @param <T> query result type
   *
   * @return query runners for this task
   */
  <T> QueryRunner<T> getQueryRunner(Query<T> query);

  /**
   * Declares which resources provided by {@link PeonProcessingModule} this task actually needs. The default
   * implementation has all the optional items disabled.

View on GitHub (pinned to 9b90983fd2)

Solutions

  1. Disable input-source-based security, or restrict it to task types that support it (those overriding getInputSourceResources).
  2. Implement getInputSourceResources() in the custom/task type, returning the ResourceActions for the task's declared input sources.
  3. Route authorization for unsupported task types through the legacy resource-action path (getNeededResourceActions) instead of the input-source path.

Example fix

// before
class MyCustomTask implements Task { /* no override */ }
// after
@Override
@JsonIgnore
@Nonnull
public Set<ResourceAction> getInputSourceResources() throws UOE {
  return getInputSources().stream()
      .flatMap(is -> is.ofType(InputResourceMapper.class).orElseThrow().toResourceActions(false).stream())
      .collect(Collectors.toSet());
}
Defensive patterns

Strategy: type-guard

Validate before calling

if (!taskClassOverrides(task, "getInputSourceResources") && inputSourceSecurityEnabled) {
  throw new IllegalArgumentException("Task type does not support input-source security: " + task.getType());
}

Type guard

boolean supportsInputSourceSecurity(Task t) {
  try { t.getInputSourceResources(); return true; } catch (UnsupportedOperationException e) { return false; }
}

Try / catch

try {
  resourceActions.addAll(task.getInputSourceResources());
} catch (UnsupportedOperationException e) {
  log.warn("Task %s lacks input-source security support, using legacy resources", task.getType());
  resourceActions.addAll(task.getNeededResourceActions());
}

Prevention

When it happens

Trigger: Calling getInputSourceResources() (directly or via getNeededResourceActionsForTask) on a task type that does not override the method — e.g. non-ingestion tasks like KillTask, MarkTask, or compact tasks — while input-source-based security is enabled (druid.auth input security authorization enabled).

Common situations: Enabling input-source security on a cluster running task types that never implemented input source resource declaration; custom task extensions that lack the override; tests exercising resource actions for arbitrary task types.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

AI-assisted analysis of apache/druid@9b90983fd2 (2026-09-07). Data as JSON: /api/errors/99872c84afc34d04. Report an issue: GitHub.