prestodb/presto · error · RuntimeException

Authentication error

Error message

Authentication error

What it means

LdapAuthenticator.authenticate catches javax.naming.NamingException (any non-authentication LDAP failure: connection refused, TLS handshake failure, DNS failure, timeout, malformed DN) and rethrows a generic RuntimeException("Authentication error"). Unlike AuthenticationException, this means the LDAP directory could not be reached or queried at all, not that the credentials were wrong.

Source

Thrown at presto-password-authenticators/src/main/java/com/facebook/presto/password/ldap/LdapAuthenticator.java:119

    private Principal authenticate(String user, String password)
    {
        Map<String, String> environment = createEnvironment(user, password);
        DirContext context = null;
        try {
            context = createDirContext(environment);
            checkForGroupMembership(user, context);

            log.debug("Authentication successful for user [%s]", user);
            return new BasicPrincipal(user);
        }
        catch (AuthenticationException e) {
            log.debug("Authentication failed for user [%s]: %s", user, e.getMessage());
            throw new AccessDeniedException("Invalid credentials");
        }
        catch (NamingException e) {
            log.debug(e, "Authentication error for user [%s]", user);
            throw new RuntimeException("Authentication error");
        }
        finally {
            if (context != null) {
                closeContext(context);
            }
        }
    }

    private Map<String, String> createEnvironment(String user, String password)
    {
        return ImmutableMap.<String, String>builder()
                .putAll(basicEnvironment)
                .put(SECURITY_AUTHENTICATION, "simple")
                .put(SECURITY_PRINCIPAL, createPrincipal(user))
                .put(SECURITY_CREDENTIALS, password)
                .build();
    }

View on GitHub (pinned to 55bb57d202)

Solutions

1. Check connectivity from the coordinator: test the ldap.url host/port (nc -vz ldap.example.com 636 or ldapsearch)
2. Fix TLS trust: import the LDAP server certificate chain into the coordinator truststore and verify the ldaps:// URL
3. Validate that the user-bind-pattern yields a well-formed DN for the attempted username (escape special characters)
4. Check LDAP server availability/logs for an outage and retry once the directory is reachable

Example fix

// before
presto.ldap.url=ldaps://ldap.internal:636  // cert not trusted -> NamingException
// after
# keytool -importcert -file ldap.crt -keystore truststore.jks
presto.ldap.url=ldaps://ldap.internal:636
# with -Djavax.net.ssl.trustStore=/etc/presto/truststore.jks

// Pre-flight LDAP reachability check:
try (Socket s = new Socket()) {
    s.connect(new InetSocketAddress("ldap.example.com", 636), 3000); // throws if unreachable
}

try {
    return ldapAuthenticator.authenticate(user, password);
} catch (RuntimeException e) {
    if ("Authentication error".equals(e.getMessage())) { // NamingException path
        // LDAP infra problem, not bad credentials: fail with 503, not 401
        throw new WebApplicationException(Status.SERVICE_UNAVAILABLE);
    }
    throw e;
}

When it happens

Trigger: During authenticate(), creating the InitialLdapContext or performing the bind throws a NamingException other than AuthenticationException: LDAP host unreachable, wrong port, TLS/certificate failure, or InvalidNameException from a malformed DN built from the username.

Common situations: LDAP hostname/port wrong or firewall blocking; LDAPS certificate not in the coordinator truststore; ldap.url uses ldaps:// with misconfigured TLS; username characters yielding an invalid DN; LDAP server down during rolling restart.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• PROMETHEUS_SECURE_COMMUNICATION_ERROR
• ARROW_FLIGHT_INVALID_KEY_ERROR
• ARROW_FLIGHT_INVALID_CERT_ERROR
• ARROW_FLIGHT_CLIENT_ERROR
• Error setting up SSL:

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/2011429e5b6ee995. Report an issue: GitHub.