{"record":{"id":"7f16e746c60fb671","repo":"apache/druid","slug":"authresult-geterrormessage-7f16e7","errorCode":null,"errorMessage":"authResult.getErrorMessage()","messagePattern":"authResult\\.getErrorMessage\\(\\)","errorType":"http","errorClass":"ForbiddenException","httpStatus":403,"severity":"error","filePath":"indexing-service/src/main/java/org/apache/druid/indexing/overlord/sampler/SamplerResource.java","lineNumber":82,"sourceCode":"  @Consumes(MediaType.APPLICATION_JSON)\n  @Produces(MediaType.APPLICATION_JSON)\n  public SamplerResponse post(final SamplerSpec sampler, @Context final HttpServletRequest req)\n  {\n    Preconditions.checkNotNull(sampler, \"Request body cannot be empty\");\n    Set<ResourceAction> resourceActions = new HashSet<>();\n    resourceActions.add(STATE_RESOURCE_WRITE);\n    if (authConfig.isEnableInputSourceSecurity()) {\n      resourceActions.addAll(sampler.getInputSourceResources());\n    }\n\n    AuthorizationResult authResult = AuthorizationUtils.authorizeAllResourceActions(\n        req,\n        resourceActions,\n        authorizerMapper\n    );\n\n    if (!authResult.allowAccessWithNoRestriction()) {\n      throw new ForbiddenException(authResult.getErrorMessage());\n    }\n    return sampler.sample();\n  }\n}\n","sourceCodeStart":64,"sourceCodeEnd":87,"githubUrl":"https://github.com/apache/druid/blob/9b90983fd291f26935af934383ce360473179e4d/indexing-service/src/main/java/org/apache/druid/indexing/overlord/sampler/SamplerResource.java#L64-L87","documentation":"SamplerResource throws ForbiddenException (HTTP 403) with the authorizer's denial message when the caller is not authorized for the resource actions implied by the sampling request (typically WRITE/READ on the target datasource derived from the DataSchema). The filter-style check runs inside the POST handler before sampling executes. The message states which resource action failed.","triggerScenarios":"POST /druid/indexer/v1/sampler where the authenticated user's roles do not cover the datasource named in the request's dataSchema (or any datasource resourceActions computed from it).","commonSituations":"Using the web-console data loader as a user whose role lacks the datasource grants; sampling against a datasource the team has no access to; authorizer misconfiguration after datasource rename; anonymous user when anonymity is not permitted.","solutions":["Grant the user's role the required ResourceActions (usually WRITE) on the target datasource","Check the overlord log for the Access object message describing the exact denial","Perform sampling as a user with sufficient privileges or change the dataSchema datasource to one you can access","Fix the authorizer/authenticator mapping if the wrong authorizer handled the request"],"exampleFix":"// before: user role lacks 'wiki' WRITE\n// after: add to role\n// {\"resource\": {\"name\": \"wiki\", \"type\": \"DATASOURCE\"}, \"actions\": [\"WRITE\"]}","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try { await samplerPost(payload); } catch (e) { if (e.status === 403) { requestDatasourceWriteGrant(payload.dataSchema.dataSource); } else throw e; }","preventionTips":["Ensure sampling users have WRITE on the preview datasource","Derive the datasource from the spec and check grants before calling the API","Prefer a dedicated service account for console data-loader previews"],"tags":["http","authorization","security","ingestion"],"backgroundTag":"permission-denied","analyzedSha":"9b90983fd291f26935af934383ce360473179e4d","analyzedAt":"2026-09-07T13:32:30.957Z","contentChangedAt":"2026-09-07T13:32:30.957Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}