{"record":{"id":"84b6b103ea512550","repo":"apache/druid","slug":"invalid-opauri-s","errorCode":null,"errorMessage":"Invalid opaUri: %s","messagePattern":"Invalid opaUri: (.+?)","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions-contrib/druid-opa-authorizer/src/main/java/org/apache/druid/security/opa/OpaAuthorizer.java","lineNumber":94,"sourceCode":"        timeoutMs,\n        HttpClient.newBuilder()\n                  .connectTimeout(Duration.ofMillis(timeoutMs != null ? timeoutMs : DEFAULT_TIMEOUT_MS))\n                  .build()\n    );\n  }\n\n  public OpaAuthorizer(\n      String name,\n      String opaUri,\n      Long timeoutMs,\n      HttpClient httpClient\n  )\n  {\n    try {\n      this.opaUri = new URI(opaUri);\n    }\n    catch (Exception e) {\n      throw new IllegalArgumentException(\"Invalid opaUri: \" + opaUri, e);\n    }\n    this.objectMapper =\n        new ObjectMapper()\n            // https://github.com/stackabletech/druid-opa-authorizer/issues/72\n            // OPA server can send other fields, such as `decision_id` when enabling decision logs\n            // We could add all the fields we *currently* know, but it's more future-proof to ignore\n            // any unknown fields.\n            .configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false);\n\n    this.timeout = Duration.ofMillis(timeoutMs != null ? timeoutMs : DEFAULT_TIMEOUT_MS);\n    this.httpClient = httpClient;\n    // name is required for @JsonCreator but unused in this implementation\n    LOG.debug(\"Created OpaAuthorizer [%s]\", name);\n  }\n\n  @Override\n  public Access authorize(\n      AuthenticationResult authenticationResult,","sourceCodeStart":76,"sourceCodeEnd":112,"githubUrl":"https://github.com/apache/druid/blob/9b90983fd291f26935af934383ce360473179e4d/extensions-contrib/druid-opa-authorizer/src/main/java/org/apache/druid/security/opa/OpaAuthorizer.java#L76-L112","documentation":"Authorizer constructor guard: the configured opaUri cannot be parsed as a URI (bad syntax, stray characters, or missing scheme), so authorizer creation fails with this message carrying the parse exception as cause.","triggerScenarios":"Thrown at extensions-contrib/druid-opa-authorizer/src/main/java/org/apache/druid/security/opa/OpaAuthorizer.java:94 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Set opaUri to a valid absolute URI, e.g. http://opa-host:8181/v1/data/druid/authz/allow.","Check for spaces, illegal characters, or a missing scheme in the configured value."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"9b90983fd291f26935af934383ce360473179e4d","analyzedAt":"2026-09-07T13:32:30.957Z","contentChangedAt":"2026-09-07T13:32:30.957Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}