{"record":{"id":"e0bf13260ff3a87d","repo":"apache/druid","slug":"invalid-authenticationtoken-type","errorCode":null,"errorMessage":"Invalid AuthenticationToken type","messagePattern":"Invalid AuthenticationToken type","errorType":"exception","errorClass":"AuthenticationException","httpStatus":401,"severity":"error","filePath":"extensions-core/druid-kerberos/src/main/java/org/apache/druid/security/kerberos/KerberosAuthenticator.java","lineNumber":204,"sourceCode":"        Cookie[] cookies = request.getCookies();\n        if (cookies != null) {\n          for (Cookie cookie : cookies) {\n            if (cookie.getName().equals(AuthenticatedURL.AUTH_COOKIE)) {\n              tokenStr = cookie.getValue();\n              try {\n                tokenStr = mySigner.verifyAndExtract(tokenStr);\n              }\n              catch (SignerException ex) {\n                throw new AuthenticationException(ex);\n              }\n              break;\n            }\n          }\n        }\n        if (tokenStr != null) {\n          token = AuthenticationToken.parse(tokenStr);\n          if (!token.getType().equals(getAuthenticationHandler().getType())) {\n            throw new AuthenticationException(\"Invalid AuthenticationToken type\");\n          }\n          if (token.isExpired()) {\n            throw new AuthenticationException(\"AuthenticationToken expired\");\n          }\n        }\n        return token;\n      }\n\n      @Override\n      public void doFilter(ServletRequest request, ServletResponse response, FilterChain filterChain)\n          throws IOException, ServletException\n      {\n        // If there's already an auth result, then we have authenticated already, skip this.\n        if (request.getAttribute(AuthConfig.DRUID_AUTHENTICATION_RESULT) != null) {\n          filterChain.doFilter(request, response);\n          return;\n        }\n","sourceCodeStart":186,"sourceCodeEnd":222,"githubUrl":"https://github.com/apache/druid/blob/9b90983fd291f26935af934383ce360473179e4d/extensions-core/druid-kerberos/src/main/java/org/apache/druid/security/kerberos/KerberosAuthenticator.java#L186-L222","documentation":"In KerberosAuthenticator.getToken, the cookie-derived AuthenticationToken parsed from the request is compared against the handler's declared type. A mismatch means the stored token was issued by a different authentication scheme, so it is rejected with AuthenticationException.","triggerScenarios":"doFilterSuper -> getToken parses a token string from the request/cookie whose getType() differs from getAuthenticationHandler().getType() (e.g. a token cookie left over from a previous, different authenticator).","commonSituations":"Switching authenticator chains (e.g. from basic to kerberos) while browsers retain old auth cookies; load-balanced cluster with inconsistent auth configurations across nodes; upgraded cluster where the token type/serializer changed.","solutions":["Clear stale authentication cookies in the client (or the 'druid_' auth cookie) and re-authenticate","Ensure all nodes in the cluster use the same authenticator type configuration","After an authenticator change, restart/roll the cluster so tokens are reissued under the new type"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// client-side: drop cookies from previous authenticators before reconnect\n// e.g. new CookieManager().getCookieStore().removeAll();","typeGuard":null,"tryCatchPattern":"try {\n  filter.doFilter(req, res, chain);\n} catch (AuthenticationException e) {\n  if (\"Invalid AuthenticationToken type\".equals(e.getMessage())) {\n    res.setHeader(\"WWW-Authenticate\", \"Negotiate\"); res.sendError(401); // force renegotiation\n  }\n}","preventionTips":["Keep the authenticator type identical on all nodes behind a load balancer","Clear auth cookies after changing the authenticator chain","Version/token-type check on client side when switching auth schemes"],"tags":["kerberos","authentication","token"],"backgroundTag":"invalid-enum-value","analyzedSha":"9b90983fd291f26935af934383ce360473179e4d","analyzedAt":"2026-09-07T13:32:30.957Z","contentChangedAt":"2026-09-07T13:32:30.957Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}