{"record":{"id":"2d993f18c5ec522b","repo":"apache/druid","slug":"access-check-result-s","errorCode":null,"errorMessage":"Access-Check-Result: %s","messagePattern":"Access-Check-Result: (.+?)","errorType":"http","errorClass":"WebApplicationException","httpStatus":403,"severity":"warning","filePath":"extensions-core/druid-basic-security/src/main/java/org/apache/druid/security/basic/BasicSecurityResourceFilter.java","lineNumber":64,"sourceCode":"    super(authorizerMapper);\n  }\n\n  @Override\n  public ContainerRequest filter(ContainerRequest request)\n  {\n    final ResourceAction resourceAction = new ResourceAction(\n        new Resource(SECURITY_RESOURCE_NAME, ResourceType.CONFIG),\n        getAction(request)\n    );\n\n    final AuthorizationResult authResult = AuthorizationUtils.authorizeResourceAction(\n        getReq(),\n        resourceAction,\n        getAuthorizerMapper()\n    );\n\n    if (!authResult.allowAccessWithNoRestriction()) {\n      throw new WebApplicationException(\n          Response.status(Response.Status.FORBIDDEN)\n                  .type(MediaType.TEXT_PLAIN)\n                  .entity(StringUtils.format(\"Access-Check-Result: %s\", authResult.getErrorMessage()))\n                  .build()\n      );\n    }\n\n    return request;\n  }\n}\n","sourceCodeStart":46,"sourceCodeEnd":75,"githubUrl":"https://github.com/apache/druid/blob/9b90983fd291f26935af934383ce360473179e4d/extensions-core/druid-basic-security/src/main/java/org/apache/druid/security/basic/BasicSecurityResourceFilter.java#L46-L75","documentation":"Not a thrown exception but the HTTP 403 response body produced by BasicSecurityResourceFilter.filter when the authorization check denies a request. The filter calls checkAccess via the AuthorizerMapper and, if the Access object does not allow access with no restriction, it returns a FORBIDDEN response whose entity is 'Access-Check-Result: <errorMessage>'. The errorMessage explains why access was denied.","triggerScenarios":"Any authenticated request to a basic-security-protected resource where the user's roles lack the required resource/action permission — e.g. a user without admin role calling the coordinator/druid basic-security API, or a role with insufficient resource name/type filters.","commonSituations":"User assigned roles missing READ/WRITE permissions on the resource; role resource filters restricted to a different datasource prefix; credentials valid (auth passed) but authorization failed; misconfigured group mappings not granting expected roles.","solutions":["Read the errorMessage in the response body to see the denial reason","Check which roles the user has via the basic-security /users API and compare with required permissions","Add or fix the role's permission entries (resource name/type/action) in the authorizer configuration","Verify group mappings correctly assign users to roles"],"exampleFix":"// before (client sees 403)\ncurl -u basicUser:pass http://coordinator/druid-ext/basic-security/... \n// after: grant the role permission first\ncurl -u admin:pass -X POST http://coordinator/druid-ext/basic-security/authorizer/basic/roles/<role> -H 'Content-Type: application/json' -d '{\"resource\":{\"name\":\".*\",\"type\":\"DATASOURCE\"},\"action\":\"READ\"}'","handlingStrategy":"validation","validationCode":"// client-side precheck\nboolean canAccess(AuthorizerMapper mapper, AuthenticationResult auth, Resource r, Action a) {\n  return mapper.getAuthorizer(auth.getAuthorizerName()) != null\n      && checkAccess(mapper, auth, r, a).isAllowed();\n}","typeGuard":null,"tryCatchPattern":"try { invokeProtectedApi(); } catch (ForbiddenException | WebApplicationException e) { if (((WebApplicationException) e).getResponse().getStatus() == 403) { LOG.error(\"Access-Check-Result: %s\", e.getResponse().readEntity(String.class)); } }","preventionTips":["Check the user's assigned roles via the basic-security users API before calling protected endpoints","Grant roles with the correct resource name/type/action patterns (use \".*\" prefixes where appropriate)","Verify group mappings actually match the user and map to intended roles","Distinguish authentication (401) from authorization (403) failures when debugging"],"tags":["authorization","http-403","security","rest"],"backgroundTag":"permission-denied","analyzedSha":"9b90983fd291f26935af934383ce360473179e4d","analyzedAt":"2026-09-07T13:32:30.957Z","contentChangedAt":"2026-09-07T13:32:30.957Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}