prestodb/presto · error · SQLException

Authentication using external authorization requires SSL to

Error message

Authentication using external authorization requires SSL to be enabled

What it means

PrestoDriverUri.setupClient requires SSL when external authorization (external authentication/redirect flow) is configured; a non-HTTPS JDBC URL cannot safely perform the external auth challenge, so this SQLException is raised during connection setup.

Source

Thrown at presto-jdbc/src/main/java/com/facebook/presto/jdbc/PrestoDriverUri.java:307

                        KERBEROS_KEYTAB_PATH.getValue(properties),
                        Optional.ofNullable(KERBEROS_CREDENTIAL_CACHE_PATH.getValue(properties)
                                .orElseGet(() -> defaultCredentialCachePath().map(File::new).orElse(null))));
            }

            Map<String, String> extraCredentials = EXTRA_CREDENTIALS.getValue(properties).orElse(ImmutableMap.of());
            Optional.ofNullable(extraCredentials.get(GCS_CREDENTIALS_PATH_KEY))
                    .ifPresent(credentialPath -> OkHttpUtil.setupGCSOauth(builder, credentialPath, Optional.ofNullable(extraCredentials.get(GCS_OAUTH_SCOPES_KEY))));

            if (ACCESS_TOKEN.getValue(properties).isPresent()) {
                if (!useSecureConnection) {
                    throw new SQLException("Authentication using an access token requires SSL to be enabled");
                }
                builder.addInterceptor(tokenAuth(ACCESS_TOKEN.getValue(properties).get()));
            }

            if (EXTERNAL_AUTHENTICATION.getValue(properties).orElse(false)) {
                if (!useSecureConnection) {
                    throw new SQLException("Authentication using external authorization requires SSL to be enabled");
                }

                // create HTTP client that shares the same settings, but without the external authenticator
                TokenPoller poller = new HttpTokenPoller(builder.build());

                Duration timeout = EXTERNAL_AUTHENTICATION_TIMEOUT.getValue(properties)
                        .map(value -> Duration.ofMillis(value.toMillis()))
                        .orElse(Duration.ofMinutes(2));

                KnownTokenCache knownTokenCache = EXTERNAL_AUTHENTICATION_TOKEN_CACHE.getValue(properties).get();
                Optional<RedirectHandler> configuredHandler = EXTERNAL_AUTHENTICATION_REDIRECT_HANDLERS.getValue(properties)
                        .map(CompositeRedirectHandler::new)
                        .map(RedirectHandler.class::cast);
                RedirectHandler redirectHandler = Optional.ofNullable(REDIRECT_HANDLER.get())
                        .orElseGet(() -> configuredHandler.orElseThrow(() -> new RuntimeException("External authentication redirect handler is not configured")));
                ExternalAuthenticator authenticator = new ExternalAuthenticator(redirectHandler, poller, knownTokenCache.create(), timeout);

                builder.authenticator(authenticator);

View on GitHub (pinned to 55bb57d202)

Solutions

1. Connect with an https:// JDBC URL when using external authentication
2. Disable external authentication if connecting over plain HTTP is acceptable for the environment

When it happens

Trigger: Thrown at presto-jdbc/src/main/java/com/facebook/presto/jdbc/PrestoDriverUri.java:307 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.
• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/94bb01949571dd02. Report an issue: GitHub.