{"record":{"id":"183fbab0421b6e79","repo":"apache/druid","slug":"authenticationtoken-ignored","errorCode":null,"errorMessage":"AuthenticationToken ignored: ","messagePattern":"AuthenticationToken ignored: ","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"extensions-core/druid-kerberos/src/main/java/org/apache/druid/security/kerberos/KerberosAuthenticator.java","lineNumber":257,"sourceCode":"       * can check the request.\n       */\n      private void doFilterSuper(ServletRequest request, ServletResponse response, FilterChain filterChain)\n          throws IOException, ServletException\n      {\n        boolean unauthorizedResponse = true;\n        int errCode = HttpServletResponse.SC_UNAUTHORIZED;\n        AuthenticationException authenticationEx = null;\n        HttpServletRequest httpRequest = (HttpServletRequest) request;\n        HttpServletResponse httpResponse = (HttpServletResponse) response;\n        boolean isHttps = \"https\".equals(httpRequest.getScheme());\n        try {\n          boolean newToken = false;\n          AuthenticationToken token;\n          try {\n            token = getToken(httpRequest);\n          }\n          catch (AuthenticationException ex) {\n            log.warn(\"AuthenticationToken ignored: \" + ex.getMessage());\n            // will be sent back in a 401 unless filter authenticates\n            authenticationEx = ex;\n            token = null;\n          }\n          if (getAuthenticationHandler().managementOperation(token, httpRequest, httpResponse)) {\n            if (token == null) {\n              if (log.isDebugEnabled()) {\n                log.debug(\"Request [{%s}] triggering authentication\", getRequestURL(httpRequest));\n              }\n              token = getAuthenticationHandler().authenticate(httpRequest, httpResponse);\n              if (token != null && token.getExpires() != 0 &&\n                  token != AuthenticationToken.ANONYMOUS) {\n                token.setExpires(System.currentTimeMillis() + getValidity() * 1000);\n              }\n              newToken = true;\n            }\n            if (token != null) {\n              unauthorizedResponse = false;","sourceCodeStart":239,"sourceCodeEnd":275,"githubUrl":"https://github.com/apache/druid/blob/9b90983fd291f26935af934383ce360473179e4d/extensions-core/druid-kerberos/src/main/java/org/apache/druid/security/kerberos/KerberosAuthenticator.java#L239-L275","documentation":"KerberosAuthenticator.doFilterSuper() attempts to extract an AuthenticationToken from the incoming HTTP request via getToken(). If that throws AuthenticationException (e.g. a malformed or invalid auth token/Authorization header), the token is discarded, this warning is logged with the exception message, and the request proceeds unauthenticated — usually answered with a 401 challenge.","triggerScenarios":"A request carries an Authorization header (Negotiate/Bearer/cookie token) that getToken() cannot parse or validate: corrupted base64, invalid Kerberos SPNEGO blob, expired cookie token, or unsupported auth scheme.","commonSituations":"Clients sending stale cached Kerberos tickets; curl/browser replaying an expired auth cookie; middleboxes mangling the Authorization header; misconfigured clients sending plain Basic auth where Negotiate is required.","solutions":["Re-authenticate: clear cached credentials (e.g. re-run kinit, clear browser cookies for the host) so a fresh token is sent.","Read the appended exception message in the log to identify the exact parse/validation failure.","Verify the client uses the expected scheme (Negotiate/SPNEGO for Kerberos) rather than an unsupported one.","If seen on every request, check server clock skew against the KDC — expired tokens cause repeated rejection."],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"try { authenticate(request); }\ncatch (AuthenticationException e) {\n  LOG.warn(\"token ignored: {}\", e.getMessage());\n  response.setHeader(\"WWW-Authenticate\", \"Negotiate\");\n  response.sendError(401); // client re-authenticates with fresh token\n}","preventionTips":["Refresh Kerberos tickets (kinit) before long-running jobs.","Clear stale auth cookies when tests fail with 401s.","Keep client clocks within Kerberos tolerance (usually 5 min)."],"tags":["kerberos","http","authentication","token","spnego"],"backgroundTag":"authentication-required","analyzedSha":"9b90983fd291f26935af934383ce360473179e4d","analyzedAt":"2026-09-07T13:32:30.957Z","contentChangedAt":"2026-09-07T13:32:30.957Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}