{"record":{"id":"cd40adb62d4231c3","repo":"apache/druid","slug":"no-authorizer-found-with-name-s","errorCode":null,"errorMessage":"No authorizer found with name: [%s].","messagePattern":"No authorizer found with name: \\[(.+?)\\]\\.","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"server/src/main/java/org/apache/druid/server/security/AuthorizationUtils.java","lineNumber":229,"sourceCode":"   * <p>\n   * If one of the resource-actions denys access, returns deny access immediately.\n   *\n   * @param authenticationResult Authentication result representing identity of requester\n   * @param resourceActions      An Iterable of resource-actions to authorize\n   * @return AuthorizationResult containing allow/deny access to the resource actions, along with policy restrictions.\n   */\n  public static AuthorizationResult authorizeAllResourceActions(\n      final AuthenticationResult authenticationResult,\n      final Iterable<ResourceAction> resourceActions,\n      final AuthorizerMapper authorizerMapper\n  )\n  {\n    final Authorizer authorizer = authorizerMapper.getAuthorizer(authenticationResult.getAuthorizerName());\n    if (authorizer == null) {\n      final String msg =\n          StringUtils.format(\"No authorizer found with name: [%s].\", authenticationResult.getAuthorizerName());\n      emitAuthMetric(authorizerMapper.getServiceEmitter(), authenticationResult, null, METRIC_EXCEPTION, null);\n      throw new ISE(msg);\n    }\n\n    // this method returns on first failure, so only successful Access results are kept in the cache\n    final Set<ResourceAction> resultCache = new HashSet<>();\n    final Map<String, Optional<Policy>> policyFilters = new HashMap<>();\n\n    for (ResourceAction resourceAction : resourceActions) {\n      if (resultCache.contains(resourceAction)) {\n        continue;\n      }\n      final Access access = authorizer.authorize(\n          authenticationResult,\n          resourceAction.getResource(),\n          resourceAction.getAction()\n      );\n      if (!access.isAllowed()) {\n        emitAuthMetric(authorizerMapper.getServiceEmitter(), authenticationResult, resourceAction, METRIC_FORBIDDEN, access.getMessage());\n        return AuthorizationResult.deny(access.getMessage());","sourceCodeStart":211,"sourceCodeEnd":247,"githubUrl":"https://github.com/apache/druid/blob/9b90983fd291f26935af934383ce360473179e4d/server/src/main/java/org/apache/druid/server/security/AuthorizationUtils.java#L211-L247","documentation":"AuthorizationUtils.authorizeAllResourceActions looks up the Authorizer named by AuthenticationResult.getAuthorizerName() from the AuthorizerMapper; if none is registered it throws IllegalArgumentException-free ISE \"No authorizer found with name: [...]\". This indicates the authentication result references an authorizer that does not exist in the runtime configuration.","triggerScenarios":"An authenticator (e.g. Basic/Kerberos) sets an authorizerName in its AuthenticationResult that is not defined under druid.auth.authorizers, or the authorizer name is misspelled/misconfigured.","commonSituations":"Config typo in authenticator's authorizerName; authorizer removed from druid.auth.authorizers but authenticator still references it; rolling upgrade where configs differ across the cluster.","solutions":["Add the referenced authorizer to druid.auth.authorizers and define it under druid.auth.authorizers.<name>.","Fix the authenticator's authorizerName property to match an existing authorizer.","Restart the service after correcting the runtime properties.","Check cluster-wide config consistency so all nodes register the same authorizers."],"exampleFix":"// before\n// druid.auth.authenticator.basic.authorizerName = myAuthr // typo\n// after\n// druid.auth.authenticator.basic.authorizerName = myAuthorizer\n// druid.auth.authorizers = [\"myAuthorizer\"]","handlingStrategy":"validation","validationCode":"if (authorizerMapper.getAuthorizer(authenticationResult.getAuthorizerName()) == null) {\n  throw new ISE(\"Configured authorizer '%s' is not registered; check druid.auth.authorizers\", authenticationResult.getAuthorizerName());\n}","typeGuard":null,"tryCatchPattern":"try { AuthorizationUtils.authorizeAllResourceActions(req, resourceActions, authorizerMapper); }\ncatch (ISE e) { if (e.getMessage().startsWith(\"No authorizer found\")) { alertConfigIssue(e); } else { throw e; } }","preventionTips":["Keep authenticator authorizerName and druid.auth.authorizers lists in sync.","Validate auth config at startup with a check that every authenticator's authorizer exists.","Use a shared config template across the cluster to avoid drift."],"tags":["authorization","config","ise"],"backgroundTag":"resource-not-found","analyzedSha":"9b90983fd291f26935af934383ce360473179e4d","analyzedAt":"2026-09-07T13:32:30.957Z","contentChangedAt":"2026-09-07T13:32:30.957Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}