{"record":{"id":"d6ffacbafd301eca","repo":"apache/druid","slug":"user-s-does-not-exist-d6ffac","errorCode":null,"errorMessage":"User [%s] does not exist.","messagePattern":"User \\[(.+?)\\] does not exist\\.","errorType":"http","errorClass":"BasicSecurityDBResourceException","httpStatus":400,"severity":"error","filePath":"extensions-core/druid-basic-security/src/main/java/org/apache/druid/security/basic/authorization/endpoint/CoordinatorBasicAuthorizerResourceHandler.java","lineNumber":466,"sourceCode":"  {\n    return Response.status(Response.Status.BAD_REQUEST)\n                   .entity(ImmutableMap.<String, Object>of(\n                       \"error\", bsre.getMessage()\n                   ))\n                   .build();\n  }\n\n  private Response getUserSimple(String authorizerName, String userName)\n  {\n    Map<String, BasicAuthorizerUser> userMap = BasicAuthUtils.deserializeAuthorizerUserMap(\n        objectMapper,\n        storageUpdater.getCurrentUserMapBytes(authorizerName)\n    );\n\n    try {\n      BasicAuthorizerUser user = userMap.get(userName);\n      if (user == null) {\n        throw new BasicSecurityDBResourceException(\"User [%s] does not exist.\", userName);\n      }\n      return Response.ok(user).build();\n    }\n    catch (BasicSecurityDBResourceException e) {\n      return makeResponseForBasicSecurityDBResourceException(e);\n    }\n  }\n\n  private Response getUserFull(String authorizerName, String userName, boolean simplifyPermissions)\n  {\n    Map<String, BasicAuthorizerUser> userMap = BasicAuthUtils.deserializeAuthorizerUserMap(\n        objectMapper,\n        storageUpdater.getCurrentUserMapBytes(authorizerName)\n    );\n\n    try {\n      BasicAuthorizerUser user = userMap.get(userName);\n      if (user == null) {","sourceCodeStart":448,"sourceCodeEnd":484,"githubUrl":"https://github.com/apache/druid/blob/9b90983fd291f26935af934383ce360473179e4d/extensions-core/druid-basic-security/src/main/java/org/apache/druid/security/basic/authorization/endpoint/CoordinatorBasicAuthorizerResourceHandler.java#L448-L484","documentation":"Returned by the coordinator basic authorizer resource handler when a GET for a single user finds no user with that name in the authorizer's current user map. The handler catches BasicSecurityDBResourceException from the storage updater and converts it into an error HTTP response instead of returning a user payload.","triggerScenarios":"GET /druid-ext/basic-security/authorization/db/v1/<authorizerName>/users/<userName> with a username that was never created or was deleted; typo in userName; querying the wrong authorizerName; user removed by another admin between listing and fetching.","commonSituations":"Scripts that iterate over remembered usernames after the users were deleted; case-sensitivity mistakes (Druid usernames are case-sensitive); pointing integration tooling at a fresh metadata store with no users; misconfigured authorizerName in client config.","solutions":["List users first (GET .../users) and confirm the exact name before fetching one","Create the user via POST .../users/<userName> if it should exist","Check authorizerName in the request/config (e.g. 'internal' vs a custom authenticator's authorizer)","Handle the 400/404 response in callers instead of assuming the user exists"],"exampleFix":"// before\nBasicAuthorizerUser u = client.getUser(\"internal-auth\", \"Alice\");\n// after (names are case-sensitive; verify existence)\nList<BasicAuthorizerUser> users = client.getUsers(\"internal-auth\");\nif (users.stream().anyMatch(x -> x.getName().equals(\"alice\"))) {\n  BasicAuthorizerUser u = client.getUser(\"internal-auth\", \"alice\");\n}","handlingStrategy":"try-catch","validationCode":"// verify user exists before fetching\nboolean exists = listUsers(authorizer).stream()\n    .anyMatch(u -> u.getName().equals(userName));\nif (!exists) return null;","typeGuard":"boolean userExists(List<BasicAuthorizerUser> users, String name) {\n  return users != null && name != null && users.stream().anyMatch(u -> name.equals(u.getName()));\n}","tryCatchPattern":"try {\n  return getUser(authorizer, userName);\n} catch (BasicSecurityDBResourceException e) {\n  if (e.getMessage().contains(\"does not exist\")) return null; // caller decides\n  throw e;\n}","preventionTips":["Remember usernames are case-sensitive in Druid","Drive iteration from live listings, not cached name lists","Confirm the authorizerName matches your authenticator config","Handle missing-user responses in clients instead of assuming existence"],"tags":["druid","basic-security","authorization","rest-api"],"backgroundTag":"user-not-found","analyzedSha":"9b90983fd291f26935af934383ce360473179e4d","analyzedAt":"2026-09-07T13:32:30.957Z","contentChangedAt":"2026-09-07T13:32:30.957Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}