{"record":{"id":"4ff4962fb1fe2a65","repo":"apache/druid","slug":"failed-to-deserialize-authorizer-role-ignoring","errorCode":null,"errorMessage":"Failed to deserialize authorizer role, ignoring: %s","messagePattern":"Failed to deserialize authorizer role, ignoring: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"extensions-core/druid-basic-security/src/main/java/org/apache/druid/security/basic/authorization/entity/BasicAuthorizerRole.java","lineNumber":117,"sourceCode":"        JsonParser jsonParser,\n        DeserializationContext deserializationContext\n    ) throws IOException\n    {\n      List<BasicAuthorizerPermission> permissions = new ArrayList<>();\n      // sanity check\n      ObjectCodec codec = jsonParser.getCodec();\n      JsonNode hopefullyAnArray = codec.readTree(jsonParser);\n      if (!hopefullyAnArray.isArray()) {\n        throw new RE(\"Failed to deserialize authorizer role list\");\n      }\n\n      for (JsonNode node : hopefullyAnArray) {\n        try {\n          permissions.add(codec.treeToValue(node, BasicAuthorizerPermission.class));\n        }\n        catch (JsonProcessingException e) {\n          // ignore unparseable, it might be resource types we don't know about\n          log.warn(e, \"Failed to deserialize authorizer role, ignoring: %s\", node.toPrettyString());\n        }\n      }\n\n      return permissions;\n    }\n  }\n}\n","sourceCodeStart":99,"sourceCodeEnd":125,"githubUrl":"https://github.com/apache/druid/blob/9b90983fd291f26935af934383ce360473179e4d/extensions-core/druid-basic-security/src/main/java/org/apache/druid/security/basic/authorization/entity/BasicAuthorizerRole.java#L99-L125","documentation":"BasicAuthorizerRole's permission deserializer parses each permission node in a role individually; if one node cannot be converted to a BasicAuthorizerPermission (JsonProcessingException), it logs this warning with the node's pretty-printed JSON and skips it instead of failing the whole role. Unknown/newer permission resource types are deliberately ignored for cross-version compatibility.","triggerScenarios":"Loading authorizer role metadata whose permissions array contains an entry that does not match BasicAuthorizerPermission's schema (unknown resourceType/action values, malformed fields).","commonSituations":"Roles edited by hand in metadata storage; roles created by a newer Druid version being read by an older one; corrupted or partially-updated metadata store rows; migration scripts writing incompatible permission JSON.","solutions":["Inspect the logged pretty-printed node to see which permission is malformed and fix or remove it in the metadata store","Recreate the role through the API so permissions conform to BasicAuthorizerPermission schema","Align Druid versions across the cluster if roles come from a newer version","Back up and clean authorizer tables in the metadata store if corruption is widespread","If the dropped permission is intentional/unknown, the warning is safe to ignore"],"exampleFix":"// before: hand-edited permission with unknown resourceType\n{\"resourceName\":\"x\",\"action\":\"READ\",\"type\":\"MysteryType\"}\n// after: valid permission\n{\"resource\":{\"name\":\"x\",\"type\":\"DATASOURCE\"},\"action\":\"READ\"}","handlingStrategy":"validation","validationCode":"// validate permission nodes against the schema before persisting roles\nfor (JsonNode node : permissionsArray) {\n  mapper.treeToValue(node, BasicAuthorizerPermission.class); // throws if invalid\n}","typeGuard":null,"tryCatchPattern":"try {\n  role = mapper.readValue(bytes, BasicAuthorizerRole.class);\n} catch (JsonProcessingException e) {\n  log.warn(e, \"role contains unparseable permissions; they will be skipped\");\n}","preventionTips":["Manage roles via the security API, not hand-edited metadata","Keep Druid versions consistent across the cluster","Back up authorizer metadata tables before migrations","Audit logs for 'Failed to deserialize authorizer role' after upgrades"],"tags":["security","json","deserialization","druid"],"backgroundTag":"json-unmarshal-failed","analyzedSha":"9b90983fd291f26935af934383ce360473179e4d","analyzedAt":"2026-09-07T13:32:30.957Z","contentChangedAt":"2026-09-07T13:32:30.957Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}