apache/hadoop · error · AuthenticationException

Authentication failed, URL: {}, status: {}, message: {}

Error message

Authentication failed, URL: {}, status: {}, message: {}

What it means

This AuthenticationException is thrown while checking an authenticated connection's response: for any status that is not a success (OK/CREATED/ACCEPTED) or 404, the token is cleared and the exception embeds the URL, HTTP status, and server message. Practically it means the server refused the authenticated request — the exact status is in the text. It is thrown by the AuthenticatedURL helpers that validate/extract the token from a live response (the extractToken-style path, including its backwards-compatible invocation on connections not opened through this instance).

Source

Thrown at hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/client/AuthenticatedURL.java:403

   * @throws AuthenticationException if an authentication exception occurred.
   */
  public static void extractToken(HttpURLConnection conn, Token token) throws IOException, AuthenticationException {
    int respCode = conn.getResponseCode();
    if (respCode == HttpURLConnection.HTTP_OK
        || respCode == HttpURLConnection.HTTP_CREATED
        || respCode == HttpURLConnection.HTTP_ACCEPTED) {
      // cookie handler should have already extracted the token.  try again
      // for backwards compatibility if this method is called on a connection
      // not opened via this instance.
      token.cookieHandler.put(null, conn.getHeaderFields());
    } else if (respCode == HttpURLConnection.HTTP_NOT_FOUND) {
      LOG.trace("Setting token value to null ({}), resp={}", token, respCode);
      token.set(null);
      throw new FileNotFoundException(conn.getURL().toString());
    } else {
      LOG.trace("Setting token value to null ({}), resp={}", token, respCode);
      token.set(null);
      throw new AuthenticationException("Authentication failed" +
          ", URL: " + conn.getURL() +
          ", status: " + conn.getResponseCode() +
          ", message: " + conn.getResponseMessage());
    }
  }

}

View on GitHub (pinned to 2add963021)

Solutions

1. Parse the status from the message: 401 -> discard the token and re-authenticate via Authenticator.authenticate(); 403 -> fix authorization (proxyuser ACLs, permissions); 5xx -> check server-side logs and retry after recovery.
2. Discard and recreate the Token on this exception — the helper already set it null; do not reuse the old cookie.
3. Verify client and server clocks and hadoop.http.authentication.token.validity if 401s appear systematically.
4. If servers rotate signing secrets, coordinate client re-auth or increase validity; check the authentication filter secret file sync across instances.

Example fix

// before
HttpURLConnection conn = new AuthenticatedURL().openConnection(url, token);

// after
try {
  HttpURLConnection conn = new AuthenticatedURL().openConnection(url, token);
} catch (AuthenticationException e) {
  token = new AuthenticatedURL.Token(); // cookie already cleared
  new KerberosAuthenticator().authenticate(url, token); // re-auth, then retry
}

try {
  HttpURLConnection conn = new AuthenticatedURL().openConnection(url, token);
} catch (AuthenticationException e) {
  String msg = e.getMessage();
  if (msg.contains("status: 401")) { reauthenticate(url, token); retry(); }
  else if (msg.contains("status: 403")) { throw new AccessDeniedException(url.toString()); }
  else { throw e; }
}

When it happens

Trigger: Calling the token-extraction/validation helper on a connection whose response code is 401/403/5xx: token rejected after expiry or signing-secret rotation (401), user not authorized (403), or backend errors (500/503) while the authentication filter is in front. Also using a Token whose cookie was invalidated server-side.

Common situations: Long-running clients holding a hadoop.auth cookie past validity; servers rotating the signing secret (restart with new secret invalidates all cookies); proxy/load balancer returning 502/503 that surfaces as this message; access attempts to a protected resource by an unauthorized user.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Invalid SPNEGO sequence, status code: {}
• Unauthorized access
• Invalid AuthenticationToken type
• AuthenticationToken expired
• tokenStr cannot be null

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/9c6be08da95dcd32. Report an issue: GitHub.