apache/druid · critical · UOE

The gRPC query server requires either a Basic or Anonymous a

Error message

The gRPC query server requires either a Basic or Anonymous authorizer: it does not work with others yet.

What it means

At server startup, QueryServer.makeSecurityInterceptor inspects the configured authenticator/authorizer chain. The gRPC extension only knows how to build its security interceptor for Basic auth or the Anonymous authenticator; any other authenticator type reaches the fall-through code, logs the message, and throws UOE("The gRPC query server requires either a Basic or Anonymous authorizer: ..."), preventing the server from starting.

Source

Thrown at extensions-contrib/grpc-query/src/main/java/org/apache/druid/grpc/server/QueryServer.java:118

      // BasicHTTPAuthenticator is not visible here.
      if ("BasicHTTPAuthenticator".equals(authenticator.getClass().getSimpleName())) {
        log.info("Using Basic authentication");
        return new BasicAuthServerInterceptor(authenticator);
      }
    }

    // Otherwise, look for an Anonymous authenticator
    for (Authenticator authenticator : authMapper.getAuthenticatorChain()) {
      if (authenticator instanceof AnonymousAuthenticator || authenticator instanceof AllowAllAuthenticator) {
        log.info("Using Anonymous authentication");
        return new AnonymousAuthServerInterceptor(authenticator);
      }
    }

    // gRPC does not support other forms of authenticators yet.
    String msg = "The gRPC query server requires either a Basic or Anonymous authorizer: it does not work with others yet.";
    log.error(msg);
    throw new UOE(msg);
  }

  public void stop() throws InterruptedException
  {
    if (server != null) {
      log.info("Server stopping");
      healthService.unregisterService(QueryService.class.getSimpleName());
      healthService.unregisterService("");
      server.shutdown().awaitTermination(30, TimeUnit.SECONDS);
    }
  }

  /**
   * Await termination on the main thread since the grpc library uses daemon threads.
   */
  public void blockUntilShutdown() throws InterruptedException
  {
    if (server != null) {

View on GitHub (pinned to 9b90983fd2)

Solutions

1. Configure a basic authenticator in druid.auth.authenticators for the gRPC-enabled process, e.g. {"name":"basic","type":"basic"}.
2. Alternatively configure the anonymous authenticator ({"name":"anonymous","type":"anonymous"}) for unsecured/dev setups.
3. Remove or reorder the authenticator chain so a Basic or Anonymous authenticator is present and usable by the gRPC server.
4. Check the extension version/docs for whether newer releases support your authenticator type before attempting custom changes.

Example fix

// before: druid.auth.authenticators=[{"name":"kerberos","type":"kerberos"}]
// after
druid.auth.authenticators=[{"name":"basic","type":"basic"}, {"name":"anonymous","type":"anonymous"}]

// Pre-flight: verify config includes a basic or anonymous authenticator before starting
Object[] auths = props.get("druid.auth.authenticators");
boolean ok = Arrays.stream(auths).anyMatch(a -> "basic".equals(a.type) || "anonymous".equals(a.type));
if (!ok) throw new IllegalStateException("gRPC server needs a Basic or Anonymous authenticator");

try {
  queryServer.start();
} catch (UnsupportedOperationException e) {
  if (e.getMessage() != null && e.getMessage().contains("Basic or Anonymous authorizer")) {
    throw new IllegalStateException("Fix druid.auth.authenticators: add {name:basic,type:basic} or anonymous", e);
  }
  throw e;
}

When it happens

Trigger: Starting a Druid process with the gRPC query extension enabled while the authenticators list contains only non-Basic authenticators (e.g. JWT, Kerberos, or an empty chain without anonymous), so the interceptor factory cannot select a Basic or Anonymous authenticator.

Common situations: Copying the auth config from a cluster secured with Kerberos/JWT into a gRPC-enabled node; forgetting to configure druid.auth.authenticators at all (no Anonymous authenticator defined); extension version predates support for other authenticator types.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• Either set 'key' or 'sharedAccessStorageToken' or 'useAzureC
• Set only one of 'key' or 'sharedAccessStorageToken' or 'useA
• SQLCatalogManager only works with SQL based metadata store a
• Principal not defined in configuration
• Keytab not defined in configuration

AI-assisted analysis of apache/druid@9b90983fd2 (2026-09-07). Data as JSON: /api/errors/e953186fd41bec1f. Report an issue: GitHub.