{"record":{"id":"4bcb96943456f974","repo":"apache/druid","slug":"authenticationresult-is-null-where-it-should-never","errorCode":null,"errorMessage":"authenticationResult is null where it should never be.","messagePattern":"authenticationResult is null where it should never be\\.","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions-contrib/druid-ranger-security/src/main/java/org/apache/druid/security/ranger/authorizer/RangerAuthorizer.java","lineNumber":90,"sourceCode":"      try {\n        UserGroupInformation.loginUserFromKeytab(principal, keytab);\n      }\n      catch (IOException ioe) {\n        throw new RuntimeException(ioe);\n      }\n    }\n\n    rangerPlugin = new RangerBasePlugin(RANGER_DRUID_SERVICETYPE, RANGER_DRUID_APPID);\n    rangerPlugin.init();\n    rangerPlugin.setResultProcessor(new RangerDefaultAuditHandler());\n\n  }\n\n  @Override\n  public Access authorize(AuthenticationResult authenticationResult, Resource resource, Action action)\n  {\n    if (authenticationResult == null) {\n      throw new IAE(\"authenticationResult is null where it should never be.\");\n    }\n\n    Set<String> userGroups = null;\n    if (useUgi) {\n      UserGroupInformation ugi = UserGroupInformation.createRemoteUser(authenticationResult.getIdentity());\n      String[] groups = ugi != null ? ugi.getGroupNames() : null;\n      if (groups != null && groups.length > 0) {\n        userGroups = new HashSet<>(Arrays.asList(groups));\n      }\n    }\n\n    RangerDruidResource rangerDruidResource = new RangerDruidResource(resource);\n    RangerDruidAccessRequest request = new RangerDruidAccessRequest(\n        rangerDruidResource,\n        authenticationResult.getIdentity(),\n        userGroups,\n        action\n    );","sourceCodeStart":72,"sourceCodeEnd":108,"githubUrl":"https://github.com/apache/druid/blob/9b90983fd291f26935af934383ce360473179e4d/extensions-contrib/druid-ranger-security/src/main/java/org/apache/druid/security/ranger/authorizer/RangerAuthorizer.java#L72-L108","documentation":"Defensive guard in RangerAuthorizer.authorize: authorization is invoked with a null AuthenticationResult, which should be impossible after successful authentication. A null here indicates an upstream wiring problem (authorizer called outside an authenticated request context), so the authorizer fails fast rather than NPE later.","triggerScenarios":"Thrown at extensions-contrib/druid-ranger-security/src/main/java/org/apache/druid/security/ranger/authorizer/RangerAuthorizer.java:90 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Ensure requests reaching this authorizer have passed through Druid authentication and that the authenticator chain is correctly configured.","Check for custom extensions or internal calls that invoke Authorizer.authorize directly without an AuthenticationResult.","Review server logs upstream of this error to find which request path produced a null identity."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"9b90983fd291f26935af934383ce360473179e4d","analyzedAt":"2026-09-07T13:32:30.957Z","contentChangedAt":"2026-09-07T13:32:30.957Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}