{"record":{"id":"626e9babc2552044","repo":"apache/druid","slug":"could-not-create-user-s-due-to-concurrent-updat","errorCode":null,"errorMessage":"Could not create user [%s] due to concurrent update contention.","messagePattern":"Could not create user \\[(.+?)\\] due to concurrent update contention\\.","errorType":"exception","errorClass":"IllegalStateException","httpStatus":500,"severity":"error","filePath":"extensions-core/druid-basic-security/src/main/java/org/apache/druid/security/basic/authorization/db/updater/CoordinatorBasicAuthorizerMetadataStorageUpdater.java","lineNumber":669,"sourceCode":"  }\n\n  private void createUserInternal(String prefix, String userName)\n  {\n    int attempts = 0;\n    while (attempts < numRetries) {\n      if (createUserOnce(prefix, userName)) {\n        return;\n      } else {\n        attempts++;\n      }\n      try {\n        Thread.sleep(ThreadLocalRandom.current().nextLong(UPDATE_RETRY_DELAY));\n      }\n      catch (InterruptedException ie) {\n        throw new RuntimeException(ie);\n      }\n    }\n    throw new ISE(\"Could not create user [%s] due to concurrent update contention.\", userName);\n  }\n\n  private void deleteUserInternal(String prefix, String userName)\n  {\n    int attempts = 0;\n    while (attempts < numRetries) {\n      if (deleteUserOnce(prefix, userName)) {\n        return;\n      } else {\n        attempts++;\n      }\n      try {\n        Thread.sleep(ThreadLocalRandom.current().nextLong(UPDATE_RETRY_DELAY));\n      }\n      catch (InterruptedException ie) {\n        throw new RuntimeException(ie);\n      }\n    }","sourceCodeStart":651,"sourceCodeEnd":687,"githubUrl":"https://github.com/apache/druid/blob/9b90983fd291f26935af934383ce360473179e4d/extensions-core/druid-basic-security/src/main/java/org/apache/druid/security/basic/authorization/db/updater/CoordinatorBasicAuthorizerMetadataStorageUpdater.java#L651-L687","documentation":"Thrown as IllegalStateException when createUserInternal exhausts all retries while trying to create a user in the authorizer user map via compare-and-swap. Concurrent modifications of the shared user map prevented the update from committing within the retry budget. This can also surface during startup via initSuperUsersAndGroupMapping.","triggerScenarios":"Calling createUser on the authorizer storage updater (or cluster startup writing super-users) while other writers repeatedly change the same authorizer user map so every CAS fails.","commonSituations":"Multiple coordinators writing simultaneously (leadership ambiguity); concurrent admin/API user creation; slow or overloaded metadata store lengthening the contention window; init-time races when several nodes start with authorizer updates enabled.","solutions":["Verify a single coordinator leader is performing authorizer updates","Reduce concurrent authorizer user-management traffic and retry the create","Check metadata store health and latency","Increase retry parameters or upgrade Druid if the contention pattern is known"],"exampleFix":"// before\nclient.createAuthorizerUser(authorizerName, userName); // ISE under contention\n// after\ntry {\n  client.createAuthorizerUser(authorizerName, userName);\n} catch (IllegalStateException e) {\n  backoffAndRetry(() -> client.createAuthorizerUser(authorizerName, userName));\n}","handlingStrategy":"retry","validationCode":"// check existence first to avoid CAS churn\nResponse r = client.getAuthorizerUser(authorizerName, userName);\nif (r.getStatus() == 200) { /* already exists */ return; }","typeGuard":null,"tryCatchPattern":"try {\n  client.createAuthorizerUser(authorizerName, userName);\n} catch (IllegalStateException e) {\n  backoffAndRetry(() -> client.createAuthorizerUser(authorizerName, userName));\n}","preventionTips":["Guarantee single-coordinator leadership for authorizer updates","Avoid parallel authorizer user creation from multiple tools","Watch metadata store health; slow stores increase CAS failure rates"],"tags":["concurrency","optimistic-locking","authorization","basic-security"],"backgroundTag":"internal-invariant-violation","analyzedSha":"9b90983fd291f26935af934383ce360473179e4d","analyzedAt":"2026-09-07T13:32:30.957Z","contentChangedAt":"2026-09-07T13:32:30.957Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}