fix: Treat empty string in hadoop.auth cookie as no cookie

[rzepinskip]

Description

This PR fixes a bug (#19519) in the druid-kerberos extension where an expired or empty Kerberos authentication cookie would short-circuit the entire authenticator chain, resulting in a persistent HTTP 403 error and preventing other authenticators (like LDAP) from handling the request.

Fixed Kerberos authentication chain short-circuit

When a Kerberos session expires, the browser may be left with an empty hadoop.auth cookie. Previously, KerberosAuthenticator would attempt to verify this empty cookie, causing a SignerException that blocked the rest of the authenticator chain.

Key fixes:

• Cookie Deletion: Added Max-Age=0 to the Set-Cookie header when clearing the hadoop.auth cookie. Previously, the browser would treat the empty-value cookie as a session cookie rather than deleting it.
• Empty Cookie Handling: Updated getToken() to explicitly check for empty cookie values. Empty cookies are now treated as "no cookie present," allowing the request to proceed to the next authenticator in the chain instead of throwing a 403 error.

Code quality and test fixes

• Fixed compilation: Added missing mockito-core dependency to druid-kerberos to resolve test compilation errors.
• Modernized Java: Adopted Java 17 pattern variables and updated string checks to use isEmpty().
• Resolved lint warnings:
  • Replaced identity comparison (!=) for AuthenticationToken.ANONYMOUS with .equals().
  • Added missing @Nullable annotations to standard override methods.
  • Marked internal configuration fields as final.

Release note

Fixed a bug in druid-kerberos where an expired authentication cookie could prevent other authenticators in the chain from working, causing a persistent 403 error.

---

Key changed/added classes in this PR

• KerberosAuthenticator
• KerberosAuthenticatorTest
• pom.xml (druid-kerberos)

---

This PR has:

• been self-reviewed.
• a release note entry in the PR description.
• added unit tests or modified existing tests to cover new code paths, ensuring the threshold for code coverage is met.
• been tested in a test Druid cluster.

[FrankChen021]

I have reviewed the code for correctness, edge cases, concurrency, and integration risks; no issues found.

Reviewed 3 of 3 changed files.

---

This is an automated review by Codex GPT-5.5

[FrankChen021]

I have reviewed the code for correctness, edge cases, concurrency, and integration risks; no issues found.

Reviewed 3 of 3 changed files.

---

This is an automated review by Codex GPT-5.5