{"record":{"id":"39a2810c5a20c5e2","repo":"apache/druid","slug":"got-an-unexpected-response-status-s-when-loading","errorCode":null,"errorMessage":"Got an unexpected response status[%s] when loading group mappings.","messagePattern":"Got an unexpected response status\\[(.+?)\\] when loading group mappings\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"extensions-core/druid-basic-security/src/main/java/org/apache/druid/security/basic/authorization/db/cache/CoordinatorPollingBasicAuthorizerCacheManager.java","lineNumber":444,"sourceCode":"        StringUtils.format(\"/druid-ext/basic-security/authorization/db/%s/cachedSerializedGroupMappingMap\", prefix)\n    );\n    BytesFullResponseHolder responseHolder = coordinatorClient.request(\n        req,\n        new BytesFullResponseHandler()\n    );\n\n    final HttpResponseStatus status = responseHolder.getStatus();\n\n    // cachedSerializedGroupMappingMap is a new endpoint introduced in Druid 0.17.0. For backwards compatibility, if we\n    // get a 404 from the coordinator we stop retrying. This can happen during a rolling upgrade when a process\n    // running 0.17.0+ tries to access this endpoint on an older coordinator.\n    if (HttpResponseStatus.NOT_FOUND.equals(status)) {\n      LOG.warn(\"cachedSerializedGroupMappingMap is not available from the coordinator, skipping fetch of group mappings for now.\");\n      return null;\n    }\n\n    if (!HttpResponseStatus.OK.equals(status)) {\n      LOG.warn(\"Got an unexpected response status[%s] when loading group mappings.\", status);\n    }\n\n    byte[] groupRoleMapBytes = responseHolder.getContent();\n\n    GroupMappingAndRoleMap groupMappingAndRoleMap = objectMapper.readValue(\n        groupRoleMapBytes,\n        BasicAuthUtils.AUTHORIZER_GROUP_MAPPING_AND_ROLE_MAP_TYPE_REFERENCE\n    );\n    if (groupMappingAndRoleMap != null && commonCacheConfig.getCacheDirectory() != null) {\n      writeGroupMappingMapToDisk(prefix, groupRoleMapBytes);\n    }\n    return groupMappingAndRoleMap;\n  }\n\n  private void initUserMaps()\n  {\n    AuthorizerMapper authorizerMapper = injector.getInstance(AuthorizerMapper.class);\n","sourceCodeStart":426,"sourceCodeEnd":462,"githubUrl":"https://github.com/apache/druid/blob/9b90983fd291f26935af934383ce360473179e4d/extensions-core/druid-basic-security/src/main/java/org/apache/druid/security/basic/authorization/db/cache/CoordinatorPollingBasicAuthorizerCacheManager.java#L426-L462","documentation":"tryFetchGroupMappingMapsFromCoordinator() logs this warning when the coordinator responds with a status other than 200 OK or 404 NOT_FOUND for the group-mappings endpoint. The method continues and attempts to parse the (likely empty or error) response body, which will typically fail downstream; the warning flags the unexpected status.","triggerScenarios":"The group-mappings fetch receives a non-200/non-404 HTTP status — e.g., 500 from a coordinator internal error, 401/403 from auth filters, 503 during coordinator leadership transitions.","commonSituations":"Coordinator not fully started or losing leadership; inter-process authentication (druid.auth) intercepting and rejecting the internal request; coordinator hitting an internal error building the group mapping map; proxy returning 502/504.","solutions":["Check coordinator logs for the underlying error that produced the non-200 status","Confirm internal authentication/authorizer config allows the authorizer cache manager to reach the coordinator","Retry after the coordinator stabilizes (the polling loop retries on the next interval)","Check whether the coordinator is the leader; group mapping fetch must go to the leader","Inspect any deserialization exception that follows for malformed response content"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// verify coordinator is leader and reachable before fetching\nHttpGet leaderCheck = new HttpGet(\"http://coordinator:8081/status/leader\");","typeGuard":null,"tryCatchPattern":"if (status != 200 && status != 404) {\n  log.warn(\"group mapping fetch got status %s; will retry next poll\", status);\n  scheduleRetryWithBackoff();\n}","preventionTips":["Ensure internal druid.auth credentials are configured for coordinator access","Monitor coordinator leadership transitions","Alert on persistent non-200 statuses from internal endpoints","Keep coordinators healthy to avoid 500/503 on metadata endpoints"],"tags":["security","druid","http","coordinator"],"backgroundTag":"http-non-200-response","analyzedSha":"9b90983fd291f26935af934383ce360473179e4d","analyzedAt":"2026-09-07T13:32:30.957Z","contentChangedAt":"2026-09-07T13:32:30.957Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}