{"record":{"id":"eded14eb008ecdb9","repo":"apache/druid","slug":"failed-to-authenticate-to-schema-registry-for-avro","errorCode":null,"errorMessage":"Failed to authenticate to schema registry for Avro schema id[%s]. Please check your credentials.","messagePattern":"Failed to authenticate to schema registry for Avro schema id\\[(.+?)\\]\\. Please check your credentials\\.","errorType":"exception","errorClass":"ParseException","httpStatus":null,"severity":"error","filePath":"extensions-core/avro-extensions/src/main/java/org/apache/druid/data/input/avro/SchemaRegistryBasedAvroBytesDecoder.java","lineNumber":154,"sourceCode":"    Schema schema;\n\n    try {\n      ParsedSchema parsedSchema = registry.getSchemaById(id);\n      schema = parsedSchema instanceof AvroSchema ? ((AvroSchema) parsedSchema).rawSchema() : null;\n    }\n    catch (IOException ex1) {\n      throw new ParseException(\n          null,\n          ex1,\n          \"Failed to fetch Avro schema id[%s] from registry. Check if the schema exists in the registry. Otherwise it\"\n          + \" could mean that there is malformed data in the stream or data that doesn't conform to the schema\"\n          + \" specified.\",\n          id\n      );\n    }\n    catch (RestClientException ex2) {\n      if (ex2.getErrorCode() == 401) {\n        throw new ParseException(\n            null,\n            ex2,\n            \"Failed to authenticate to schema registry for Avro schema id[%s]. Please check your credentials.\",\n            id\n        );\n      }\n      // For all other errors, just include the code and message received from the library.\n      throw new ParseException(\n          null,\n          ex2,\n          \"Failed to fetch Avro schema id[%s] from registry. Error code[%s] and message[%s].\",\n          id,\n          ex2.getErrorCode(),\n          ex2.getMessage()\n      );\n    }\n    if (schema == null) {\n      throw new ParseException(null, \"No Avro schema id[%s] in registry\", id);","sourceCodeStart":136,"sourceCodeEnd":172,"githubUrl":"https://github.com/apache/druid/blob/9b90983fd291f26935af934383ce360473179e4d/extensions-core/avro-extensions/src/main/java/org/apache/druid/data/input/avro/SchemaRegistryBasedAvroBytesDecoder.java#L136-L172","documentation":"During Avro message parsing, SchemaRegistryBasedAvroBytesDecoder looks up the schema id embedded in the message via registry.getSchemaById(id). The RestClientException catch branch converts an authentication failure (HTTP 401/403 against the schema registry) into a ParseException, meaning the configured credentials (username/password or auth scheme) are missing or invalid, so the schema — and thus the record — cannot be decoded.","triggerScenarios":"parse(ByteBuffer bytes) calls registry.getSchemaById(id); the registry responds 401 because the configured basic-auth username/password are wrong, missing, or expired (e.g., stale API key after credential rotation).","commonSituations":"Confluent Cloud schema registry requiring API key/secret but no credentials configured; credentials rotated and Druid config not updated; wrong auth type (token vs basic) for the registry.","solutions":["Check the schema registry username/password (or auth config) in the ingestion spec / schemaRegistryConfig","Verify the credentials against the registry directly (e.g. curl with the same auth) to confirm they work","If the registry recently rotated credentials, update the spec and restart/re-submit the supervisor"],"exampleFix":"// before\n\"schemaRegistryUrls\": [\"https://psrc-x.confluent.cloud\"], \"schemaRegistryAuth\": {\"username\": \"oldkey\", \"password\": \"oldsecret\"}\n// after\n\"schemaRegistryUrls\": [\"https://psrc-x.confluent.cloud\"], \"schemaRegistryAuth\": {\"username\": \"NEWKEY\", \"password\": \"NEWSECRET\"}","handlingStrategy":"try-catch","validationCode":"// verify credentials before deployment\ncurl -f -u \"$SR_USER:$SR_PASS\" https://registry.example/schemas/ids/1 > /dev/null && echo OK || echo BAD_CREDENTIALS","typeGuard":null,"tryCatchPattern":"try {\n  GenericRecord record = decoder.parse(bytes);\n} catch (ParseException e) {\n  if (e.getMessage().contains(\"Failed to authenticate\")) {\n    LOG.error(\"Schema registry credentials invalid; fail fast, do not retry\");\n    throw new IllegalStateException(\"Fix schema registry auth config\", e);\n  }\n}","preventionTips":["Manage registry credentials via secrets store with rotation hooks","Test credentials in CI against the actual registry","Set calendar reminders aligned with credential expiry policies","Use scoped, non-expiring service accounts where possible"],"tags":["avro","schema-registry","authentication"],"backgroundTag":"authentication-required","analyzedSha":"9b90983fd291f26935af934383ce360473179e4d","analyzedAt":"2026-09-07T13:32:30.957Z","contentChangedAt":"2026-09-07T13:32:30.957Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}