apache/druid · warning · BasicSecurityDBResourceException

User [%s] does not exist.

Error message

User [%s] does not exist.

What it means

Thrown as BasicSecurityDBResourceException by the coordinator's getUser endpoint when the requested user is absent from the authenticator user map. The handler catches it and converts it into an HTTP error response. It is the standard 'unknown user' signal for the basic-security authentication user API.

Source

Thrown at extensions-core/druid-basic-security/src/main/java/org/apache/druid/security/basic/authentication/endpoint/CoordinatorBasicAuthenticatorResourceHandler.java:103

  }

  @Override
  public Response getUser(String authenticatorName, String userName)
  {
    final BasicHTTPAuthenticator authenticator = authenticatorMap.get(authenticatorName);
    if (authenticator == null) {
      return makeResponseForAuthenticatorNotFound(authenticatorName);
    }

    Map<String, BasicAuthenticatorUser> userMap = BasicAuthUtils.deserializeAuthenticatorUserMap(
        objectMapper,
        storageUpdater.getCurrentUserMapBytes(authenticatorName)
    );

    try {
      BasicAuthenticatorUser user = userMap.get(userName);
      if (user == null) {
        throw new BasicSecurityDBResourceException("User [%s] does not exist.", userName);
      }
      return Response.ok(user).build();
    }
    catch (BasicSecurityDBResourceException cfe) {
      return makeResponseForBasicSecurityDBResourceException(cfe);
    }
  }

  @Override
  public Response createUser(String authenticatorName, String userName)
  {
    final BasicHTTPAuthenticator authenticator = authenticatorMap.get(authenticatorName);
    if (authenticator == null) {
      return makeResponseForAuthenticatorNotFound(authenticatorName);
    }

    try {
      storageUpdater.createUser(authenticatorName, userName);

View on GitHub (pinned to 9b90983fd2)

Solutions

1. List users (GET .../users) to confirm the exact userName before fetching
2. Verify the authenticator name matches your druid.auth.authenticators config
3. Handle the 404-style response in clients rather than assuming the user exists
4. Re-create the user if it was deleted unintentionally

Example fix

// before
Response r = client.getUser(authenticatorName, userName); // may be error response
User u = r.readEntity(User.class);
// after
Response r = client.getUser(authenticatorName, userName);
if (r.getStatus() == 404) { /* user absent: create or skip */ } else { User u = r.readEntity(User.class); }

// list users first to validate the userName
String users = client.getUsers(authenticatorName).readEntity(String.class);
boolean exists = users.contains("\"" + userName + "\"");

try {
  Response r = client.getUser(authenticatorName, userName);
  User u = r.readEntity(User.class);
} catch (WebApplicationException e) {
  if (e.getResponse().getStatus() == 404) { /* user absent: create or skip */ } else throw e;
}

When it happens

Trigger: GET /druid-ext/basic-security/authentication/<authenticator>/users/<userName> for a userName that does not exist in the stored user map.

Common situations: Typo in the userName or authenticator name; querying users on a newly created authenticator with no users; user removed by a concurrent deletion; automation reading a user before the create completed.

Understand the failure class

Background: "User not found", "Invalid user", and "does not exist": what missing-user lookup errors mean across Rocket.Chat, LiteLLM, Phabricator, rustfs, and pnpm — this error's family across 10 libraries.

Related errors

• User [%s] does not exist.
• User [%s] does not have role [%s].
• Group mapping [%s] already has role [%s].
• Group mapping [%s] does not have role [%s].
• User [%s] does not exist.

AI-assisted analysis of apache/druid@9b90983fd2 (2026-09-07). Data as JSON: /api/errors/cc327862a9191de4. Report an issue: GitHub.