{"record":{"id":"2d2af9f1cfd36f84","repo":"apache/druid","slug":"jdbc-kerberos-auth-not-supported-yet","errorCode":null,"errorMessage":"JDBC Kerberos auth not supported yet","messagePattern":"JDBC Kerberos auth not supported yet","errorType":"exception","errorClass":"UnsupportedOperationException","httpStatus":500,"severity":"error","filePath":"extensions-core/druid-kerberos/src/main/java/org/apache/druid/security/kerberos/KerberosAuthenticator.java","lineNumber":415,"sourceCode":"    return \"/*\";\n  }\n\n  @Override\n  public EnumSet<DispatcherType> getDispatcherType()\n  {\n    return null;\n  }\n\n  @Override\n  public String getAuthChallengeHeader()\n  {\n    return \"Negotiate\";\n  }\n\n  @Override\n  public AuthenticationResult authenticateJDBCContext(Map<String, Object> context)\n  {\n    throw new UnsupportedOperationException(\"JDBC Kerberos auth not supported yet\");\n  }\n\n  @Override\n  public void decorateProxyRequest(\n      HttpServletRequest clientRequest,\n      HttpServletResponse proxyResponse,\n      Request proxyRequest\n  )\n  {\n    Object cookieToken = clientRequest.getAttribute(SIGNED_TOKEN_ATTRIBUTE);\n    if (cookieToken != null && cookieToken instanceof String) {\n      log.debug(\"Found cookie token will attache it to proxyRequest as cookie\");\n      String authResult = (String) cookieToken;\n      proxyRequest.cookie(HttpCookie.from(SIGNED_TOKEN_ATTRIBUTE, authResult));\n    }\n  }\n\n  /**","sourceCodeStart":397,"sourceCodeEnd":433,"githubUrl":"https://github.com/apache/druid/blob/9b90983fd291f26935af934383ce360473179e4d/extensions-core/druid-kerberos/src/main/java/org/apache/druid/security/kerberos/KerberosAuthenticator.java#L397-L433","documentation":"KerberosAuthenticator.authenticateJDBCContext is explicitly unimplemented: kerberos authentication for JDBC connections (avatica context-based auth) is not supported, so the method unconditionally throws UnsupportedOperationException.","triggerScenarios":"Any code path calling authenticateJDBCContext(Map) — i.e. a JDBC client presenting credentials through the JDBC context map to a kerberos-protected cluster.","commonSituations":"Attempting kerberos-secured JDBC connections to Druid from tools (JDBC clients, BI tools) instead of HTTP; assuming SPNEGO browser auth also covers JDBC.","solutions":["Do not use JDBC with kerberos auth; use HTTP-level (SPNEGO) authentication instead","Authenticate over HTTP and rely on that path, or configure a different authenticator chain for JDBC-facing endpoints","Use kerberized delegation only where supported (e.g.HttpClient SPNEGO) rather than JDBC context"],"exampleFix":"// before\nMap<String,Object> ctx = Map.of(\"user\", \"kerbUser\"); // triggers authenticateJDBCContext\nconnection.setClientInfo(...); // auth attempt via JDBC context\n// after\n// authenticate over HTTP with SPNEGO, or use basic auth authenticator for JDBC endpoints","handlingStrategy":"validation","validationCode":"if (authenticator instanceof KerberosAuthenticator) {\n  throw new UnsupportedOperationException(\"Use HTTP/SPNEGO auth; JDBC kerberos auth is not supported\");\n}","typeGuard":null,"tryCatchPattern":"try {\n  result = authenticator.authenticateJDBCContext(context);\n} catch (UnsupportedOperationException e) {\n  // fall back to HTTP authentication path\n}","preventionTips":["Check the authenticator's supported auth channels before wiring JDBC clients","Route JDBC traffic through an authenticator chain that supports it (e.g. basic)","Keep SPNEGO for browser/HTTP access only"],"tags":["kerberos","jdbc","unsupported"],"backgroundTag":"operation-not-supported","analyzedSha":"9b90983fd291f26935af934383ce360473179e4d","analyzedAt":"2026-09-07T13:32:30.957Z","contentChangedAt":"2026-09-07T13:32:30.957Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}