{"record":{"id":"bbbfeb3bb047d404","repo":"apache/druid","slug":"group-mapping-s-does-not-exist","errorCode":null,"errorMessage":"Group mapping [%s] does not exist.","messagePattern":"Group mapping \\[(.+?)\\] does not exist\\.","errorType":"http","errorClass":"BasicSecurityDBResourceException","httpStatus":400,"severity":"error","filePath":"extensions-core/druid-basic-security/src/main/java/org/apache/druid/security/basic/authorization/db/updater/CoordinatorBasicAuthorizerMetadataStorageUpdater.java","lineNumber":898,"sourceCode":"  private boolean createUserOnce(String prefix, String userName)\n  {\n    byte[] oldValue = getCurrentUserMapBytes(prefix);\n    Map<String, BasicAuthorizerUser> userMap = BasicAuthUtils.deserializeAuthorizerUserMap(objectMapper, oldValue);\n    if (userMap.get(userName) != null) {\n      throw new BasicSecurityDBResourceException(\"User [%s] already exists.\", userName);\n    } else {\n      userMap.put(userName, new BasicAuthorizerUser(userName, null));\n    }\n    byte[] newValue = BasicAuthUtils.serializeAuthorizerUserMap(objectMapper, userMap);\n    return tryUpdateUserMap(prefix, userMap, oldValue, newValue);\n  }\n\n  private boolean deleteGroupMappingOnce(String prefix, String groupMappingName)\n  {\n    byte[] oldValue = getCurrentGroupMappingMapBytes(prefix);\n    Map<String, BasicAuthorizerGroupMapping> groupMappingMap = BasicAuthUtils.deserializeAuthorizerGroupMappingMap(objectMapper, oldValue);\n    if (groupMappingMap.get(groupMappingName) == null) {\n      throw new BasicSecurityDBResourceException(\"Group mapping [%s] does not exist.\", groupMappingName);\n    } else {\n      groupMappingMap.remove(groupMappingName);\n    }\n    byte[] newValue = BasicAuthUtils.serializeAuthorizerGroupMappingMap(objectMapper, groupMappingMap);\n    return tryUpdateGroupMappingMap(prefix, groupMappingMap, oldValue, newValue);\n  }\n\n  private boolean createGroupMappingOnce(String prefix, BasicAuthorizerGroupMapping groupMapping)\n  {\n    byte[] oldValue = getCurrentGroupMappingMapBytes(prefix);\n    Map<String, BasicAuthorizerGroupMapping> groupMappingMap = BasicAuthUtils.deserializeAuthorizerGroupMappingMap(objectMapper, oldValue);\n    if (groupMappingMap.get(groupMapping.getName()) != null) {\n      throw new BasicSecurityDBResourceException(\"Group mapping [%s] already exists.\", groupMapping.getName());\n    } else {\n      groupMappingMap.put(groupMapping.getName(), groupMapping);\n    }\n    byte[] newValue = BasicAuthUtils.serializeAuthorizerGroupMappingMap(objectMapper, groupMappingMap);\n    return tryUpdateGroupMappingMap(prefix, groupMappingMap, oldValue, newValue);","sourceCodeStart":880,"sourceCodeEnd":916,"githubUrl":"https://github.com/apache/druid/blob/9b90983fd291f26935af934383ce360473179e4d/extensions-core/druid-basic-security/src/main/java/org/apache/druid/security/basic/authorization/db/updater/CoordinatorBasicAuthorizerMetadataStorageUpdater.java#L880-L916","documentation":"BasicSecurityDBResourceException thrown by deleteGroupMappingOnce when the named group mapping is not found in the authorizer's group-mapping map. Deletion is only valid for existing entities; the coordinator validates presence before writing the updated map. Indicates a stale reference or wrong authorizer prefix rather than an internal failure.","triggerScenarios":"DELETE /druid-ext/basic-security/authorization/db/<authorizer>/groupMappings/<groupMappingName> for a mapping that does not exist in that authorizer.","commonSituations":"The mapping was already deleted (double delete in a script); typo in the mapping name; delete issued against the wrong authorizer; LdapGroupMapping config renamed between versions.","solutions":["List existing mappings with GET /druid-ext/basic-security/authorization/db/<authorizer>/groupMappings to confirm the exact name","Make deletes idempotent: ignore 'does not exist' responses in cleanup scripts","Check you are using the correct authorizer name in the URL path","Recreate the mapping if the delete was premature"],"exampleFix":"// before\ndeleteGroupMapping(\"default\", \"ldapAdmins\");\n// after\nif (groupMappingExists(\"default\", \"ldapAdmins\")) {\n  deleteGroupMapping(\"default\", \"ldapAdmins\");\n}","handlingStrategy":"validation","validationCode":"boolean exists = getGroupMappings(authorizer).stream()\n    .anyMatch(gm -> gm.equals(groupMappingName));\nif (!exists) log.warn(\"Skipping delete, mapping absent: \" + groupMappingName);","typeGuard":null,"tryCatchPattern":"try {\n  client.deleteGroupMapping(\"default\", name);\n} catch (BasicSecurityDBResourceException e) {\n  if (e.getMessage().contains(\"does not exist\")) {\n    log.info(\"Group mapping {} already gone\", name);\n  } else { throw e; }\n}","preventionTips":["List mappings before deleting to confirm exact names","Treat 'does not exist' as success in cleanup scripts","Keep mapping names in versioned config to avoid typos"],"tags":["security","rest-api","delete"],"backgroundTag":"entity-not-found","analyzedSha":"9b90983fd291f26935af934383ce360473179e4d","analyzedAt":"2026-09-07T13:32:30.957Z","contentChangedAt":"2026-09-07T13:32:30.957Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}