prestodb/presto · error · RuntimeException

Authentication error

Error message

Authentication error

What it means

LdapAuthenticator.authenticate catches javax.naming.NamingException (any non-authentication LDAP failure: connection refused, TLS handshake failure, DNS failure, timeout, malformed DN) and rethrows a generic RuntimeException("Authentication error"). Unlike AuthenticationException, this means the LDAP directory could not be reached or queried at all, not that the credentials were wrong.

Solutions

1. Check connectivity from the coordinator: test the ldap.url host/port (nc -vz ldap.example.com 636 or ldapsearch)
2. Fix TLS trust: import the LDAP server certificate chain into the coordinator truststore and verify the ldaps:// URL
3. Validate that the user-bind-pattern yields a well-formed DN for the attempted username (escape special characters)
4. Check LDAP server availability/logs for an outage and retry once the directory is reachable

Example fix

// before
presto.ldap.url=ldaps://ldap.internal:636  // cert not trusted -> NamingException
// after
# keytool -importcert -file ldap.crt -keystore truststore.jks
presto.ldap.url=ldaps://ldap.internal:636
# with -Djavax.net.ssl.trustStore=/etc/presto/truststore.jks

// Pre-flight LDAP reachability check:
try (Socket s = new Socket()) {
    s.connect(new InetSocketAddress("ldap.example.com", 636), 3000); // throws if unreachable
}

try {
    return ldapAuthenticator.authenticate(user, password);
} catch (RuntimeException e) {
    if ("Authentication error".equals(e.getMessage())) { // NamingException path
        // LDAP infra problem, not bad credentials: fail with 503, not 401
        throw new WebApplicationException(Status.SERVICE_UNAVAILABLE);
    }
    throw e;
}

When it happens

Trigger: During authenticate(), creating the InitialLdapContext or performing the bind throws a NamingException other than AuthenticationException: LDAP host unreachable, wrong port, TLS/certificate failure, or InvalidNameException from a malformed DN built from the username.

Common situations: LDAP hostname/port wrong or firewall blocking; LDAPS certificate not in the coordinator truststore; ldap.url uses ldaps:// with misconfigured TLS; username characters yielding an invalid DN; LDAP server down during rolling restart.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• PROMETHEUS_SECURE_COMMUNICATION_ERROR
• ARROW_FLIGHT_CLIENT_ERROR
• ARROW_FLIGHT_INVALID_CERT_ERROR
• ARROW_FLIGHT_INVALID_KEY_ERROR
• DRUID_BROKER_RESULT_ERROR

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/2011429e5b6ee995. Report an issue: GitHub.

Appendix: source

Thrown at presto-password-authenticators/src/main/java/com/facebook/presto/password/ldap/LdapAuthenticator.java:119

    private Principal authenticate(String user, String password)
    {
        Map<String, String> environment = createEnvironment(user, password);
        DirContext context = null;
        try {
            context = createDirContext(environment);
            checkForGroupMembership(user, context);

            log.debug("Authentication successful for user [%s]", user);
            return new BasicPrincipal(user);
        }
        catch (AuthenticationException e) {
            log.debug("Authentication failed for user [%s]: %s", user, e.getMessage());
            throw new AccessDeniedException("Invalid credentials");
        }
        catch (NamingException e) {
            log.debug(e, "Authentication error for user [%s]", user);
            throw new RuntimeException("Authentication error");
        }
        finally {
            if (context != null) {
                closeContext(context);
            }
        }
    }

    private Map<String, String> createEnvironment(String user, String password)
    {
        return ImmutableMap.<String, String>builder()
                .putAll(basicEnvironment)
                .put(SECURITY_AUTHENTICATION, "simple")
                .put(SECURITY_PRINCIPAL, createPrincipal(user))
                .put(SECURITY_CREDENTIALS, password)
                .build();
    }

View on GitHub (pinned to 55bb57d202)