{"record":{"id":"15785dcde9eb5d97","repo":"apache/druid","slug":"couldn-t-deserialize-authorizer-rolemap","errorCode":null,"errorMessage":"Couldn't deserialize authorizer roleMap!","messagePattern":"Couldn't deserialize authorizer roleMap!","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"extensions-core/druid-basic-security/src/main/java/org/apache/druid/security/basic/BasicAuthUtils.java","lineNumber":224,"sourceCode":"    catch (IOException ioe) {\n      throw new ISE(ioe, \"Couldn't serialize authorizer groupMappingMap!\");\n    }\n  }\n\n  public static Map<String, BasicAuthorizerRole> deserializeAuthorizerRoleMap(\n      ObjectMapper objectMapper,\n      byte[] roleMapBytes\n  )\n  {\n    Map<String, BasicAuthorizerRole> roleMap;\n    if (roleMapBytes == null) {\n      roleMap = new HashMap<>();\n    } else {\n      try {\n        roleMap = objectMapper.readValue(roleMapBytes, BasicAuthUtils.AUTHORIZER_ROLE_MAP_TYPE_REFERENCE);\n      }\n      catch (IOException ioe) {\n        throw new RuntimeException(\"Couldn't deserialize authorizer roleMap!\", ioe);\n      }\n    }\n    return roleMap;\n  }\n\n  public static byte[] serializeAuthorizerRoleMap(ObjectMapper objectMapper, Map<String, BasicAuthorizerRole> roleMap)\n  {\n    try {\n      return objectMapper.writeValueAsBytes(roleMap);\n    }\n    catch (IOException ioe) {\n      throw new ISE(ioe, \"Couldn't serialize authorizer roleMap!\");\n    }\n  }\n\n  public static void maybeInitialize(final RetryUtils.Task<?> task)\n  {\n    try {","sourceCodeStart":206,"sourceCodeEnd":242,"githubUrl":"https://github.com/apache/druid/blob/9b90983fd291f26935af934383ce360473179e4d/extensions-core/druid-basic-security/src/main/java/org/apache/druid/security/basic/BasicAuthUtils.java#L206-L242","documentation":"Thrown by BasicAuthUtils.deserializeAuthorizerRoleMap when Jackson cannot read the stored byte array back into a Map<String, BasicAuthorizerRole>. Druid persists role maps as serialized JSON in metadata storage; if those bytes are unreadable or not valid JSON of the expected shape, deserialization fails and this RuntimeException is thrown. It usually means corrupted or malformed persisted data.","triggerScenarios":"Reading roleMapBytes from metadata storage that were written by an incompatible version, truncated, corrupted, or are not JSON matching BasicAuthorizerRole's expected shape (including empty bytes that are non-null and non-empty but invalid).","commonSituations":"Upgrading Druid across schema-incompatible basic-security versions; manual edits to the druid_basic_roles metadata table; interrupted writes leaving partial JSON in the DB.","solutions":["Log/inspect the raw roleMapBytes and the wrapped IOException to identify the parse failure point","Verify the metadata-store record for the role map is complete valid JSON matching BasicAuthorizerRole","Check whether a version upgrade changed the persisted format and re-run any required migration/upgrade scripts","Restore the role map from a good metadata store backup and re-create roles via the API"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"boolean looksLikeRoleMap(byte[] b) { return b != null && b.length > 0 && b[0] == '{'; }","typeGuard":"boolean isValidRoleMapBytes(byte[] bytes) { try (JsonParser p = jsonMapper.getFactory().createParser(bytes)) { while (p.nextToken() != null) {} return true; } catch (IOException e) { return false; } }","tryCatchPattern":"try { Map<String, BasicAuthorizerRole> roles = BasicAuthUtils.deserializeAuthorizerRoleMap(jsonMapper, bytes); } catch (RuntimeException e) { LOG.error(e, \"corrupt roleMap bytes; restoring from backup\"); roles = restoreFromBackupOrDefault(); }","preventionTips":["Validate stored bytes are complete JSON before deserializing after upgrades","Back up metadata-store tables (druid_basic_roles) before version upgrades","Never hand-edit serialized role-map rows in the database","Confirm all nodes run the same Druid basic-security version"],"tags":["jackson","deserialization","metadata-store"],"backgroundTag":"json-unmarshal-failed","analyzedSha":"9b90983fd291f26935af934383ce360473179e4d","analyzedAt":"2026-09-07T13:32:30.957Z","contentChangedAt":"2026-09-07T13:32:30.957Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}