prestodb/presto · error · PinotException

PINOT_UNAUTHENTICATED_EXCEPTION

PINOT_UNAUTHENTICATED_EXCEPTION

Error message

Query authentication failed.

What it means

Thrown when the Pinot broker response contains an exception entry with errorCode 180, which Pinot uses to signal query authentication failure. The Presto Pinot connector maps that specific error code to this exception so users can distinguish auth problems from other broker-side errors.

Source

Thrown at presto-pinot-toolkit/src/main/java/com/facebook/presto/pinot/PinotBrokerPageSource.java:291

        }
    }

    protected static void handleCommonResponse(String pinotQuery, JsonNode jsonBody)
    {
        JsonNode numServersResponded = jsonBody.get("numServersResponded");
        JsonNode numServersQueried = jsonBody.get("numServersQueried");

        if (numServersQueried == null || numServersResponded == null || numServersQueried.asInt() > numServersResponded.asInt()) {
            throw new PinotException(
                PINOT_INSUFFICIENT_SERVER_RESPONSE,
                Optional.of(pinotQuery),
                String.format("Only %s out of %s servers responded for query %s", numServersResponded.asInt(), numServersQueried.asInt(), pinotQuery));
        }

        JsonNode exceptions = jsonBody.get("exceptions");
        if (exceptions != null && exceptions.isArray() && exceptions.size() > 0) {
            if (exceptions.get(0).get("errorCode").asInt() == 180) {
                throw new PinotException(
                    PINOT_UNAUTHENTICATED_EXCEPTION,
                    Optional.empty(),
                    "Query authentication failed.");
            }
            // Pinot is known to return exceptions with benign errorcodes like 200
            // so we treat any exception as an error
            throw new PinotException(
                PINOT_EXCEPTION,
                Optional.of(pinotQuery),
                String.format("Query %s encountered exception %s", pinotQuery, exceptions.get(0)));
        }
    }

    protected static String asText(JsonNode node)
    {
        if (node.isArray()) {
            String[] results = new String[node.size()];
            for (int i = 0; i < node.size(); i++) {

View on GitHub (pinned to 55bb57d202)

Solutions

1. Verify the auth token configured for the Presto Pinot connector (pinot.auth.token or equivalent config) is present and not expired
2. Regenerate the token from the Pinot access control config and update the connector properties
3. Confirm the Pinot cluster's AccessControlFactory is configured and the token type matches (e.g. BasicAuth vs custom)
4. Test the same token directly against the Pinot broker with curl to isolate whether the problem is Pinot-side or connector-side

Example fix

// before: connector properties missing or stale token
pinot.auth.token=
// after: provide a current token
pinot.auth.token=Basic <base64(user:password)>

// Validate token presence/config before querying
if (pinotAuthToken == null || pinotAuthToken.isEmpty()) {
    throw new IllegalStateException("Pinot auth token missing from connector config");
}

try {
    connector.query(sql);
} catch (PinotException e) {
    if (e.getErrorCode() == PinotErrorCode.PINOT_UNAUTHENTICATED_EXCEPTION) {
        // refresh credentials/token, then retry once
    }
    throw e;
}

When it happens

Trigger: handleCommonResponse inspects the 'exceptions' array in the broker response JSON; if exceptions.get(0).get("errorCode").asInt() == 180 the query was rejected because the supplied credentials/token were missing, expired, or invalid for the table.

Common situations: Expired access tokens configured in the connector's pinot.auth.token, wrong authentication type configured in Pinot (e.g. TLS auth vs token auth), table-level access control denying the Presto service principal.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Invalid credentials
• Invalid credentials
• Failed to create Broker auth provider
• Unknown authentication type -
• Failed to create Controller auth provider

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/076d19d8fbb9bd6c. Report an issue: GitHub.