{"record":{"id":"d652d26bd0c97f35","repo":"apache/druid","slug":"access-check-result-s-d652d2","errorCode":null,"errorMessage":"Access-Check-Result: %s","messagePattern":"Access-Check-Result: (.+?)","errorType":"http","errorClass":"WebApplicationException","httpStatus":403,"severity":"error","filePath":"indexing-service/src/main/java/org/apache/druid/indexing/overlord/http/OverlordResource.java","lineNumber":617,"sourceCode":"                       .entity(errorMessage)\n                       .build();\n      }\n    }\n    // early authorization check if datasource != null\n    // fail fast if user not authorized to access datasource\n    if (dataSource != null) {\n      final ResourceAction resourceAction = new ResourceAction(\n          new Resource(dataSource, ResourceType.DATASOURCE),\n          Action.READ\n      );\n      final AuthorizationResult authResult = AuthorizationUtils.authorizeResourceAction(\n          req,\n          resourceAction,\n          authorizerMapper\n      );\n\n      if (!authResult.allowAccessWithNoRestriction()) {\n        throw new WebApplicationException(\n            Response.status(Response.Status.FORBIDDEN)\n                    .type(MediaType.TEXT_PLAIN)\n                    .entity(StringUtils.format(\"Access-Check-Result: %s\", authResult.getErrorMessage()))\n                    .build()\n        );\n      }\n    }\n\n    return asLeaderWith(\n        taskMaster.getTaskRunner(),\n        taskRunner -> {\n          final List<TaskStatusPlus> authorizedList = securedTaskStatusPlus(\n              taskQueryTool.getTaskStatusPlusList(\n                  TaskStateLookup.fromString(state),\n                  dataSource,\n                  createdTimeInterval,\n                  maxCompletedTasks,\n                  type","sourceCodeStart":599,"sourceCodeEnd":635,"githubUrl":"https://github.com/apache/druid/blob/9b90983fd291f26935af934383ce360473179e4d/indexing-service/src/main/java/org/apache/druid/indexing/overlord/http/OverlordResource.java#L599-L635","documentation":"The task-listing endpoint (getTasks, backing waiting/pending/running/complete views) filters tasks by the caller's datasource permissions. When the authorization check fails, it returns HTTP 403 with a plain-text body containing 'Access-Check-Result: <message>'.","triggerScenarios":"GET /druid/indexer/v1/tasks (or /waiting, /pending, /running, /complete) with a dataSource/type filter the caller cannot READ, so the resource action check denies the request.","commonSituations":"Users listing tasks for datasources outside their role; API scripts using service tokens without READ on the queried datasource; a wrong datasource name mapping to an unauthorized resource.","solutions":["Query only datasources the user has READ access to, or grant READ on the requested datasource.","Remove the dataSource filter to list only authorized tasks (results are permission-filtered anyway).","Read the Access-Check-Result body to identify the denied resource/action and fix the role."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"Response r = target(\"/druid/indexer/v1/tasks\").request().get();\nif (r.getStatus() == 403) {\n  String body = r.readEntity(String.class); // Access-Check-Result: ...\n  // narrow the dataSource filter or grant READ\n}","preventionTips":["Query only datasources the caller has READ access to; otherwise omit filters.","Inspect the Access-Check-Result body to map the denial to a specific resource/action.","Keep listing credentials and datasource grants in sync."],"tags":["druid","overlord","authorization","http-403"],"backgroundTag":"permission-denied","analyzedSha":"9b90983fd291f26935af934383ce360473179e4d","analyzedAt":"2026-09-07T13:32:30.957Z","contentChangedAt":"2026-09-07T13:32:30.957Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}