prestodb/presto · warning · AccessDeniedException

Invalid credentials

Error message

Invalid credentials

What it means

FileAuthenticator.createAuthenticatedPrincipal throws AccessDeniedException("Invalid credentials") when the user's password does not match any entry in the configured password file. It is the standard authentication-rejection path for the file-based password authenticator: the credentials supplied over HTTPS basic auth failed the hash comparison.

Source

Thrown at presto-password-authenticators/src/main/java/com/facebook/presto/password/file/FileAuthenticator.java:56

    {
        File file = config.getPasswordFile();
        if (!file.exists()) {
            log.error("File %s does not exist", file.getAbsolutePath());
            throw new FileNotFoundException("File " + file.getAbsolutePath() + " does not exist");
        }
        int cacheMaxSize = config.getAuthTokenCacheMaxSize();

        passwordStoreSupplier = memoizeWithExpiration(
                () -> new PasswordStore(file, cacheMaxSize),
                config.getRefreshPeriod().toMillis(),
                MILLISECONDS);
    }

    @Override
    public Principal createAuthenticatedPrincipal(String user, String password)
    {
        if (!passwordStoreSupplier.get().authenticate(user, password)) {
            throw new AccessDeniedException("Invalid credentials");
        }

        return new BasicPrincipal(user);
    }
}

View on GitHub (pinned to 55bb57d202)

Solutions

1. Verify the client credentials (user and password) are correct and match an entry in the configured password file
2. Regenerate or update the user's entry in the password file with the correct hash (bcrypt or PBKDF2-WORKOUT/S) and reload so PasswordStore re-reads it
3. Confirm the hash algorithm of the stored entry is supported (bcrypt or PBKDF2, not plaintext or crypt)
4. Check the coordinator config (file.password-file path) points at the intended file

Example fix

// before
String password = "stale-password"; // changed on server, auth fails
// after
String password = System.getenv("PRESTO_PASSWORD"); // kept in sync with server password file

// Before deploying client config, verify credentials against the same file the server uses:
// htpasswd -vb /etc/presto/password.db <user> <password>  (exit code 0 => hash matches)

try {
    principal = authenticator.createAuthenticatedPrincipal(user, password);
} catch (AccessDeniedException e) {
    log.warn("Auth rejected for user %s", user); // do not leak whether user exists
    throw new WebApplicationException(Status.UNAUTHORIZED);
}

When it happens

Trigger: A client sends a username/password during TLS basic authentication and FilePasswordStore.authenticate() returns false because the bcrypt/pbkdf2 hash for that user does not match the supplied password, or the user has no entry in the password file.

Common situations: Typo in the client's configured credentials; password file regenerated or user entry removed while a client still uses an old credential; password stored with an unsupported hash format; client pointing at the wrong coordinator with a different password file.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Failed to create Credentials from key
• Invalid credentials
• PINOT_UNAUTHENTICATED_EXCEPTION
• UNEXPECTED_ACCUMULO_ERROR
• UNEXPECTED_ACCUMULO_ERROR

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/a70fb6d75a79e3ec. Report an issue: GitHub.