apache/hadoop · error · IllegalArgumentException

AuthenticationMethod.TOKEN + " authentication requires a sec

Error message

AuthenticationMethod.TOKEN + " authentication requires a secret manager"

What it means

Thrown while an IPC Server is being constructed (Server.getAuthMethods) when hadoop.security.authentication is set to TOKEN but the server was built with a null SecretManager. In Hadoop IPC, token (delegation token) authentication is not a standalone login method: it is implicitly enabled and put at the front of the accepted auth methods whenever a secret manager is supplied. Explicitly configuring TOKEN therefore only makes sense for tests; in a real deployment this exception means the authentication configuration is contradictory.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/ipc/Server.java:3577

        if (saslRpcServer.serverId != null) {
          builder.setServerId(saslRpcServer.serverId);
        }
      }
    }
    return negotiateBuilder.build();
  }

  // get the security type from the conf. implicitly include token support
  // if a secret manager is provided, or fail if token is the conf value but
  // there is no secret manager
  private List<AuthMethod> getAuthMethods(SecretManager<?> secretManager,
                                             Configuration conf) {
    AuthenticationMethod confAuthenticationMethod =
        SecurityUtil.getAuthenticationMethod(conf);        
    List<AuthMethod> authMethods = new ArrayList<AuthMethod>();
    if (confAuthenticationMethod == AuthenticationMethod.TOKEN) {
      if (secretManager == null) {
        throw new IllegalArgumentException(AuthenticationMethod.TOKEN +
            " authentication requires a secret manager");
      } 
    } else if (secretManager != null) {
      LOG.debug("{} authentication enabled for secret manager", AuthenticationMethod.TOKEN);
      // most preferred, go to the front of the line!
      authMethods.add(AuthenticationMethod.TOKEN.getAuthMethod());
    }
    authMethods.add(confAuthenticationMethod.getAuthMethod());        
    
    LOG.debug("Server accepts auth methods:{}", authMethods);
    return authMethods;
  }
  
  private void closeConnection(Connection connection) {
    connectionManager.close(connection);
  }

  /**

View on GitHub (pinned to 2add963021)

Solutions

1. Set hadoop.security.authentication to 'simple' (no auth) or 'kerberos' (secure) in core-site.xml — token auth is not a valid standalone value for a production server.
2. If you truly need token auth in a test or embedded server, pass a non-null SecretManager (e.g., your service's delegation-token SecretManager) when constructing the RPC server so TOKEN is implied rather than configured.
3. Check for stray core-site.xml files earlier on the classpath (hadoop conf dirs, bundled test resources) that inject the token value without your knowledge.

Example fix

// before (core-site.xml)
<property><name>hadoop.security.authentication</name><value>token</value></property>

// after
<property><name>hadoop.security.authentication</name><value>kerberos</value></property>
<!-- or 'simple'; token auth is implied by supplying a SecretManager to the server -->

AuthenticationMethod m = SecurityUtil.getAuthenticationMethod(conf);
if (m == AuthenticationMethod.TOKEN && secretManager == null) {
  throw new IllegalStateException("hadoop.security.authentication=token requires a SecretManager; "
      + "use simple/kerberos or pass a SecretManager to the RPC server builder");
}
// safe to construct the server here

try {
  server = new RPC.Builder(conf).setPort(port).setInstance(impl)
      .setProtocol(Proto.class).build();
} catch (IllegalArgumentException e) {
  // message contains 'authentication requires a secret manager'
  LOG.error("Invalid auth config: {}", e.getMessage());
  throw new ServiceInitializationException(e);
}

When it happens

Trigger: core-site.xml (or the Configuration passed to new Server(...) / RPC.getServer / RPC.Builder.build) contains hadoop.security.authentication=token while the server constructor receives secretManager=null. Typical call path: new RPC.Builder(conf).setPort(...)...build() with no setSecretManager and the token value in conf.

Common situations: Copying a core-site.xml from documentation or test resources that uses 'token'; setting hadoop.security.authentication globally to experiment with token auth without wiring a delegation secret manager; leftover cluster-wide config overriding a service-specific setting after an upgrade or config merge.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Server asks us to fall back to SIMPLE auth, but this client
• Missing keyfile property ('%s') for authentication type '%s'
• Unknown authentication type: %s
• numLevels must be at least 1
• callqueue.capacity.weights must specify ${priorityLevels} ca

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/ee9f3c92ee6d6c85. Report an issue: GitHub.