{"record":{"id":"f8b0fe35d104fa5b","repo":"apache/druid","slug":"authresult-geterrormessage-f8b0fe","errorCode":null,"errorMessage":"authResult.getErrorMessage()","messagePattern":"authResult\\.getErrorMessage\\(\\)","errorType":"http","errorClass":"ForbiddenException","httpStatus":403,"severity":"error","filePath":"indexing-service/src/main/java/org/apache/druid/indexing/overlord/http/security/SupervisorResourceFilter.java","lineNumber":107,"sourceCode":"\n    final SupervisorSpec spec = supervisorSpecOptional.get();\n    Preconditions.checkArgument(\n        spec.getDataSources() != null && spec.getDataSources().size() > 0,\n        \"No dataSources found to perform authorization checks\"\n    );\n\n    Function<String, ResourceAction> resourceActionFunction = getAction(request) == Action.READ ?\n                                                              AuthorizationUtils.DATASOURCE_READ_RA_GENERATOR :\n                                                              AuthorizationUtils.DATASOURCE_WRITE_RA_GENERATOR;\n\n    AuthorizationResult authResult = AuthorizationUtils.authorizeAllResourceActions(\n        getReq(),\n        Iterables.transform(spec.getDataSources(), resourceActionFunction),\n        getAuthorizerMapper()\n    );\n\n    if (!authResult.allowAccessWithNoRestriction()) {\n      throw new ForbiddenException(authResult.getErrorMessage());\n    }\n\n    return request;\n  }\n}\n","sourceCodeStart":89,"sourceCodeEnd":113,"githubUrl":"https://github.com/apache/druid/blob/9b90983fd291f26935af934383ce360473179e4d/indexing-service/src/main/java/org/apache/druid/indexing/overlord/http/security/SupervisorResourceFilter.java#L89-L113","documentation":"SupervisorResourceFilter throws ForbiddenException (HTTP 403) with the authorization result's error message when the caller's access to the supervisor's datasources is not unrestricted. The filter performs an Authorizer check over all datasources of the supervisor spec and denies the request if any resource action fails. The message details which datasource/authorizer check failed.","triggerScenarios":"A supervisor API request from a user whose authorizer role does not grant READ (or the required WRITE) on every datasource covered by the supervisor spec, so authResult.allowAccessWithNoRestriction() is false.","commonSituations":"User missing a role granting access to a newly added datasource in the supervisor spec; multi-datasource supervisor where only some datasources are permitted; misconfigured authorizer (e.g. default role not allowing the datasource); externalField/identity changes after SSO rotation.","solutions":["Grant the user's role READ/WRITE ResourceActions on all datasources in the supervisor spec","Check overlord logs for the underlying Access object message explaining the denial","Verify the authorizerMapper configuration and that the correct authenticator/authorizer chain handled the request","If the spec is wrong (too many datasources), update the supervisor spec to the intended set"],"exampleFix":"// before: user lacks access\n// supervisor 'kafka-ds' writes to datasource 'wiki' but role only allows 'sales'\n// after: update role in basic-security DB or JSON authorizer\n// role 'user-role' -> resources: [{name: 'wiki', type: 'DATASOURCE', actions: ['READ','WRITE']},\n//                               {name: 'sales', type: 'DATASOURCE', actions: ['READ','WRITE']}]","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try { await callSupervisorApi(id); } catch (e) { if (e.status === 403) { requestDatasourceGrants(e.message); } else throw e; }","preventionTips":["Map each supervisor spec's datasources to required role grants before submitting","Audit roles whenever a spec adds datasources","Test supervisor endpoints with a non-admin user"],"tags":["http","authorization","security","druid-overlord"],"backgroundTag":"permission-denied","analyzedSha":"9b90983fd291f26935af934383ce360473179e4d","analyzedAt":"2026-09-07T13:32:30.957Z","contentChangedAt":"2026-09-07T13:32:30.957Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}