{"record":{"id":"2e9366ef492928ee","repo":"apache/druid","slug":"authentication-exception","errorCode":null,"errorMessage":"Authentication exception: ","messagePattern":"Authentication exception: ","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"extensions-core/druid-kerberos/src/main/java/org/apache/druid/security/kerberos/KerberosAuthenticator.java","lineNumber":339,"sourceCode":"              // Since this request is validated also set DRUID_AUTHENTICATION_RESULT\n              request.setAttribute(\n                  AuthConfig.DRUID_AUTHENTICATION_RESULT,\n                  new AuthenticationResult(token.getName(), authorizerName, name, null)\n              );\n              doFilter(filterChain, httpRequest, httpResponse);\n            }\n          } else {\n            unauthorizedResponse = false;\n          }\n        }\n        catch (AuthenticationException ex) {\n          // exception from the filter itself is fatal\n          errCode = HttpServletResponse.SC_FORBIDDEN;\n          authenticationEx = ex;\n          if (log.isDebugEnabled()) {\n            log.debug(ex, \"Authentication exception: \" + ex.getMessage());\n          } else {\n            log.warn(\"Authentication exception: \" + ex.getMessage());\n          }\n        }\n        if (unauthorizedResponse) {\n          if (!httpResponse.isCommitted()) {\n            tokenToAuthCookie(\n                httpResponse,\n                \"\",\n                getCookieDomain(),\n                getCookiePath(),\n                0,\n                false,\n                isHttps\n            );\n            // If response code is 401. Then WWW-Authenticate Header should be\n            // present.. reset to 403 if not found..\n            if ((errCode == HttpServletResponse.SC_UNAUTHORIZED)\n                && (!httpResponse.containsHeader(\n                org.apache.hadoop.security.authentication.client.KerberosAuthenticator.WWW_AUTHENTICATE))) {","sourceCodeStart":321,"sourceCodeEnd":357,"githubUrl":"https://github.com/apache/druid/blob/9b90983fd291f26935af934383ce360473179e4d/extensions-core/druid-kerberos/src/main/java/org/apache/druid/security/kerberos/KerberosAuthenticator.java#L321-L357","documentation":"In doFilterSuper(), an AuthenticationException raised by the filter's own processing (rather than from token parsing) is treated as fatal: the response code is set to HTTP 403 FORBIDDEN and the exception is logged as \"Authentication exception: <message>\" (warn level, debug if enabled). Unlike the token-ignored case, the request will not proceed as anonymous.","triggerScenarios":"Authentication handler (e.g. DruidKerberosAuthenticationHandler) or token/auth-cookie validation inside the filter throws after token parsing succeeded: SPNEGO context negotiation failure, handler management-operation error, or unexpected internal exception wrapped as AuthenticationException.","commonSituations":"Broken Kerberos server-side configuration (bad keytab/principal at init), GSS context accept failures from clients presenting tickets for the wrong realm/service, cookie signature/decryption problems.","solutions":["Inspect the logged exception message and its cause to find whether the SPNEGO handshake or handler state failed.","Verify server Kerberos init succeeded (no earlier 'Failed to login as' errors) and the keytab/principal are correct.","Confirm the client is obtaining tickets for the correct service principal and realm (kvno mismatches, cross-realm issues).","Fix or reinitialize the authenticator: restart the Druid process after correcting Kerberos configuration."],"exampleFix":"// before\n// client ticket for HTTP/other-host@REALM -> 403\n// after\n// ensure client uses the SPN matching druid.auth.kerberos.principal, e.g.:\n// curl --negotiate -u : https://druid-host:8081/status","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"// server-side: ensure handler init succeeded before serving\nif (!authHandlerReady) { response.sendError(503); return; }","preventionTips":["Confirm 'Failed to login as' errors are absent at startup.","Use the exact SPN matching the configured Kerberos principal from clients.","Align kvno/realm configuration between client and KDC.","Test with curl --negotiate against the exact host:port users hit."],"tags":["kerberos","authentication","http-403","spnego"],"backgroundTag":"authentication-required","analyzedSha":"9b90983fd291f26935af934383ce360473179e4d","analyzedAt":"2026-09-07T13:32:30.957Z","contentChangedAt":"2026-09-07T13:32:30.957Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}