apache/druid · error · UnsupportedOperationException

This inputSource does not support input source based securit

Error message

This inputSource does not support input source based security

What it means

InputSource.getTypes is a default interface method that input-source implementations are supposed to override to declare their type names, used by input-source-based security (resource action mapping). The default body throws UnsupportedOperationException, so invoking it on an InputSource that has not implemented the method means the source does not participate in input-source security checks.

Source

Thrown at processing/src/main/java/org/apache/druid/data/input/InputSource.java:113

   * @param inputFormat        to parse data. It can be null if {@link #needsFormat()} = true
   * @param temporaryDirectory to store temp data. It will be cleaned up automatically once the task is finished.
   */
  InputSourceReader reader(
      InputRowSchema inputRowSchema,
      @Nullable InputFormat inputFormat,
      File temporaryDirectory
  );

  /**
   * The types of input sources uses. A set is returned here, as some InputSource implementation allow for
   * combining of multiple input sources.
   * @return The types of input sources uses
   */
  @JsonIgnore
  @Nonnull
  default Set<String> getTypes()
  {
    throw new UOE("This inputSource does not support input source based security");
  }
}

View on GitHub (pinned to 9b90983fd2)

Solutions

Override getTypes() in the custom InputSource to return its type names (e.g. Collections.singleton("http")).
Upgrade the extension providing the InputSource to a version that supports input-source based security.
Disable input-source based authorization (druid.auth.resourceActions) if it is not needed, so getTypes is not consulted.
Wrap/replace the unsupported source with a built-in InputSource that implements getTypes().

Example fix

// before
class MyInputSource implements InputSource { /* no getTypes override */ }
// after
class MyInputSource implements InputSource {
  @Override
  @Nonnull
  public Set<String> getTypes() {
    return Collections.singleton("my");
  }
}

Defensive patterns

Strategy: try-catch

Type guard

boolean supported;
try { source.getTypes(); supported = true; } catch (UOE e) { supported = false; }

Try / catch

try {
  resources = source.computeResources(dataSource);
} catch (UnsupportedOperationException e) {
  log.warn("InputSource %s does not support input-source security; falling back to datasource-level auth", source.getClass().getName());
  resources = Collections.singletonList(new ResourceAction(new Resource(dataSource, ResourceType.DATASOURCE), Action.READ));
}

Prevention

Override getTypes() in every custom InputSource
Keep extensions updated to the Druid version in use
Verify authorization config (druid.auth.resourceActions) against the installed input sources before rollout

When it happens

Trigger: Calling computeResources (InputSource#computeResources path) or otherwise invoking getTypes() on a custom or third-party InputSource that does not override getTypes(), typically during authorization of a query/ingestion with input-source-based security enabled.

Common situations: Custom extension InputSources written against older Druid APIs (before getTypes was added for input-source security) used with newer Druid with druid.auth.resourceActions enabled; built-in sources in old versions lacking the override.

Related errors

AI-assisted analysis of apache/druid@9b90983fd2 (2026-09-07). Data as JSON: /api/errors/2a5fde969d8018a3. Report an issue: GitHub.