hi, i have enabled pinot auth in helm values, for ...
# troubleshootinga
Aashiq PS
11/13/2025, 8:02 AMhi, i have enabled pinot auth in helm values, for controller and broker, but the server is showing error 401 unauthorized. can anybody guide the solution.
Copy code
pinotAuth:
enabled: true
controllerFactoryClass: org.apache.pinot.controller.api.access.BasicAuthAccessControlFactory
brokerFactoryClass: org.apache.pinot.broker.broker.BasicAuthAccessControlFactory
configs:
- access.control.principals=admin
- access.control.principals.admin.password=<password> Copy code
org.apache.pinot.common.exception.HttpErrorStatusException: Got error status code: 401 (Unauthorized) with reason: "HTTP 401 Unauthorized" while sending request: /segmentConsumed?reason=forceCommitMessageReceived&streamPartitionMsgOffset=214683&instance=Server_prod-pinot-server-0.prod-pinot-server-headless.prod-pinot.svc.cluster.local_8098&name=views__0__0__20251113T0646Z&rowCount=21&memoryUsedBytes=84567768 to controller: prod-pinot-controller-2.prod-pinot-controller-headless.prod-pinot.svc.cluster.local, version: Unknownx
Xiang Fu
11/13/2025, 10:14 AM
I think you also need to configure auth for server
Xiang Fu
11/13/2025, 10:16 AM
see if this is configured for server:
Copy code
"pinot.server.admin.access.control.factory.class":
"org.apache.pinot.server.access.BasicAuthAccessFactory"a
Aashiq PS
11/13/2025, 10:33 AM@Xiang Fu but in doc it do not mentioned for server. i have provided the values for configmap also (both minion and server)
as per doc below sections i have configured
Copy code
pinotAuth:
enabled: true
controllerFactoryClass: org.apache.pinot.controller.api.access.BasicAuthAccessControlFactory
brokerFactoryClass: org.apache.pinot.broker.broker.BasicAuthAccessControlFactory
configs:
- access.control.principals=admin
- access.control.principals.admin.password=verysecret
ConfigMaps
Controller
controller.segment.fetcher.auth.token=Basic YWRtaW46dmVyeXNlY3JldA
Minion
segment.fetcher.auth.token=Basic YWRtaW46dmVyeXNlY3JldA
task.auth.token=Basic YWRtaW46dmVyeXNlY3JldA
Server
pinot.server.segment.fetcher.auth.token=Basic YWRtaW46dmVyeXNlY3JldA
pinot.server.segment.uploader.auth.token=Basic YWRtaW46dmVyeXNlY3JldA
pinot.server.instance.auth.token=Basic YWRtaW46dmVyeXNlY3JldAx
Xiang Fu
11/13/2025, 10:43 AM
ah, you are right, you only need these at server
Copy code
pinot.server.segment.fetcher.auth.token=Basic YWRtaW46dmVyeXNlY3JldA
pinot.server.segment.uploader.auth.token=Basic YWRtaW46dmVyeXNlY3JldA
pinot.server.instance.auth.token=Basic YWRtaW46dmVyeXNlY3JldAa
Aashiq PS
11/13/2025, 10:44 AM@Xiang Fu when checking in configmap token is available, so why it is showing 401 error
x
Xiang Fu
11/13/2025, 10:46 AM
hmm, can you try to use this token to curl a controller api and ensure it working
Xiang Fu
11/13/2025, 10:47 AM
something like this
Copy code
curl -H "Content-Type: application/json" -H "authorization:Basic YWRtaW46dmVyeXNlY3JldA" prod-pinot-controller-2.prod-pinot-controller-headless.prod-pinot.svc.cluster.local:9000/tablesa
Aashiq PS
11/13/2025, 10:49 AMshowing 401
x
Xiang Fu
11/13/2025, 10:49 AM
then seems the token is wrong
a
Aashiq PS
11/13/2025, 10:50 AMcould you share a helm section for pinot auth
Aashiq PS
11/13/2025, 10:56 AMwith the example while decoding, it shows diff values, could you check
Copy code
aashiq@aashiq-HP-EliteBook-840-G6:~/Aashiq/Research/Lab$ echo -n 'YWRtaW46dmVyeXNlY3JldA' | base64 --decode
admin:verysecretbase64: invalid input
aashiq@aashiq-HP-EliteBook-840-G6:~/Aashiq/Research/Lab$ echo -n 'YWRtaW46dmVyeXNlY3JldA==' | base64 --decode
admin:verysecretaashiq@aashiq-HP-EliteBook-840-G6:~/Aashiq/Research/Lab$
aashiq@aashiq-HP-EliteBook-840-G6:~/Aashiq/Research/Lab$x
Xiang Fu
11/13/2025, 10:57 AM
I think you should try
YWRtaW46dmVyeXNlY3JldA==a
Aashiq PS
11/13/2025, 10:58 AMi tried that and it is not working
x
Xiang Fu
11/13/2025, 10:58 AM
curl command doesn't work?
Xiang Fu
11/13/2025, 11:01 AM
see if you can make server config:
Copy code
pinot.server.segment.fetcher.auth.token=Basic YWRtaW46dmVyeXNlY3JldA==
pinot.server.segment.uploader.auth.token=Basic YWRtaW46dmVyeXNlY3JldA==
pinot.server.instance.auth.token=Basic YWRtaW46dmVyeXNlY3JldA==a
Aashiq PS
11/13/2025, 11:15 AMnow it is working, but same steps i used for different password, password for admin and token created password were different. do any restriction on password characters
x
Xiang Fu
11/13/2025, 11:26 AM
it should just be base64 encoded:
admin:<your-password>a
Aashiq PS
11/13/2025, 11:27 AMok, thanks, will change and confirm