{"record":{"id":"893307303163e045","repo":"apache/druid","slug":"couldn-t-serialize-authorizer-usermap","errorCode":null,"errorMessage":"Couldn't serialize authorizer userMap!","messagePattern":"Couldn't serialize authorizer userMap!","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions-core/druid-basic-security/src/main/java/org/apache/druid/security/basic/BasicAuthUtils.java","lineNumber":178,"sourceCode":"      userMap = new HashMap<>();\n    } else {\n      try {\n        userMap = objectMapper.readValue(userMapBytes, BasicAuthUtils.AUTHORIZER_USER_MAP_TYPE_REFERENCE);\n      }\n      catch (IOException ioe) {\n        throw new RuntimeException(\"Couldn't deserialize authorizer userMap!\", ioe);\n      }\n    }\n    return userMap;\n  }\n\n  public static byte[] serializeAuthorizerUserMap(ObjectMapper objectMapper, Map<String, BasicAuthorizerUser> userMap)\n  {\n    try {\n      return objectMapper.writeValueAsBytes(userMap);\n    }\n    catch (IOException ioe) {\n      throw new ISE(ioe, \"Couldn't serialize authorizer userMap!\");\n    }\n  }\n\n  public static Map<String, BasicAuthorizerGroupMapping> deserializeAuthorizerGroupMappingMap(\n      ObjectMapper objectMapper,\n      byte[] groupMappingMapBytes\n  )\n  {\n    Map<String, BasicAuthorizerGroupMapping> groupMappingMap;\n    if (groupMappingMapBytes == null) {\n      groupMappingMap = new HashMap<>();\n    } else {\n      try {\n        groupMappingMap = objectMapper.readValue(groupMappingMapBytes, BasicAuthUtils.AUTHORIZER_GROUP_MAPPING_MAP_TYPE_REFERENCE);\n      }\n      catch (IOException ioe) {\n        throw new RuntimeException(\"Couldn't deserialize authorizer groupMappingMap!\", ioe);\n      }","sourceCodeStart":160,"sourceCodeEnd":196,"githubUrl":"https://github.com/apache/druid/blob/9b90983fd291f26935af934383ce360473179e4d/extensions-core/druid-basic-security/src/main/java/org/apache/druid/security/basic/BasicAuthUtils.java#L160-L196","documentation":"BasicAuthUtils.serializeAuthorizerUserMap serializes Map<String, BasicAuthorizerUser> to JSON bytes; a Jackson IOException becomes ISE('Couldn't serialize authorizer userMap!'). Indicates the supplied map (or its contents) can't be serialized by the given mapper.","triggerScenarios":"Persisting the authorizer user map when the wrong map type or a mapper-incompatible object is supplied.","commonSituations":"Custom extension code passing authenticator maps or foreign objects into the authorizer serializer; missing Jackson modules in a stripped-down ObjectMapper.","solutions":["Pass a properly typed Map<String, BasicAuthorizerUser> obtained from deserializeAuthorizerUserMap","Use the standard Druid ObjectMapper configuration","Add logging around serialization to capture the offending entry"],"exampleFix":"// before\nMap<String, BasicAuthenticatorUser> m = ...;\nBasicAuthUtils.serializeAuthorizerUserMap(mapper, (Map) m);\n// after\nMap<String, BasicAuthorizerUser> m = ...;\nBasicAuthUtils.serializeAuthorizerUserMap(mapper, m);","handlingStrategy":"type-guard","validationCode":"boolean valid = userMap.values().stream().allMatch(v -> v instanceof BasicAuthorizerUser);","typeGuard":"boolean isAuthorizerUserMap(Map<String, ?> m) {\n  return m.values().stream().allMatch(BasicAuthorizerUser.class::isInstance);\n}","tryCatchPattern":"try {\n  byte[] b = BasicAuthUtils.serializeAuthorizerUserMap(mapper, userMap);\n} catch (ISE e) {\n  if (e.getMessage().contains(\"Couldn't serialize authorizer userMap!\")) {\n    // rebuild the map and retry\n  } else throw e;\n}","preventionTips":["Pass correctly typed Map<String, BasicAuthorizerUser>","Do not mix authenticator and authorizer maps","Use the Druid-standard ObjectMapper in custom code"],"tags":["java","security","jackson","serialization"],"backgroundTag":"json-marshal-failed","analyzedSha":"9b90983fd291f26935af934383ce360473179e4d","analyzedAt":"2026-09-07T13:32:30.957Z","contentChangedAt":"2026-09-07T13:32:30.957Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}