apache/hadoop · warning · AuthenticationException

AuthenticationToken expired

Error message

AuthenticationToken expired

What it means

The last check in AuthenticationFilter.getToken: a parsed, type-matching token whose expiry (or max-inactive deadline) has passed throws AuthenticationException('AuthenticationToken expired'). Hadoop auth tokens embed 'expires' (issue time + validity) and optionally an 'maxInactive' timestamp; once either is in the past the cookie is dead regardless of signature. Clients are expected to re-authenticate; the browser flow does this transparently, programmatic clients must do it themselves.

Source

Thrown at hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/server/AuthenticationFilter.java:454

            throw new AuthenticationException("Unauthorized access");
          }
          try {
            tokenStr = signer.verifyAndExtract(tokenStr);
          } catch (SignerException ex) {
            throw new AuthenticationException(ex);
          }
          break;
        }
      }
    }
    if (tokenStr != null) {
      token = AuthenticationToken.parse(tokenStr);
      boolean match = verifyTokenType(getAuthenticationHandler(), token);
      if (!match) {
        throw new AuthenticationException("Invalid AuthenticationToken type");
      }
      if (token.isExpired()) {
        throw new AuthenticationException("AuthenticationToken expired");
      }
    }
    return token;
  }

  /**
   * This method verifies if the specified token type matches one of the the
   * token types supported by a specified {@link AuthenticationHandler}. This
   * method is specifically designed to work with
   * {@link CompositeAuthenticationHandler} implementation which supports
   * multiple authentication schemes while the {@link AuthenticationHandler}
   * interface supports a single type via
   * {@linkplain AuthenticationHandler#getType()} method.
   *
   * @param handler The authentication handler whose supported token types
   *                should be used for verification.
   * @param token   The token whose type needs to be verified.
   * @return true   If the token type matches one of the supported token types

View on GitHub (pinned to 2add963021)

Solutions

1. Re-authenticate to get a fresh token: programmatic clients catch AuthenticationException and rerun Authenticator.authenticate(url, token) (or UserGroupInformation relogin in kerberos setups), then retry.
2. Raise validity server-side if workflows legitimately outlive it: hadoop.http.authentication.token.validity (seconds) in the service's auth config.
3. For idle expiry, review authentication.token.max-inactive-interval vs. your session patterns.
4. Check clock synchronization (NTP/chrony) across token issuers and validators.
5. Serialize/replay tokens only within their lifetime; refresh proactively before expiry rather than on failure.

Example fix

// before
try { conn = new AuthenticatedURL().openConnection(url, token); }
catch (AuthenticationException e) { throw new RuntimeException(e); }

// after
try { conn = new AuthenticatedURL().openConnection(url, token); }
catch (AuthenticationException e) {
  if (e.getMessage().contains(EXPIRED)) {
    token = new AuthenticatedURL.Token();
    new KerberosAuthenticator().authenticate(url, token);
    conn = new AuthenticatedURL().openConnection(url, token);
  } else { throw e; }
}

// proactive refresh before expiry if you can introspect the token
long expires = parseExpiresFromToken(tokenStr);
if (expires - System.currentTimeMillis() < REFRESH_MARGIN_MS) {
  authenticator.authenticate(url, token);
}

try {
  conn = new AuthenticatedURL().openConnection(url, token);
} catch (AuthenticationException e) {
  if (e.getMessage() != null && e.getMessage().contains("expired")) {
    token = new AuthenticatedURL.Token();
    authenticator.authenticate(url, token);
    conn = new AuthenticatedURL().openConnection(url, token);
  } else { throw e; }
}

When it happens

Trigger: Requests arriving with a hadoop.auth cookie older than hadoop.http.authentication.token.validity (default 36000 s = 10 h), or idle longer than authentication.token.max-inactive-interval; server clock changes shifting 'now' past the deadline; jobs resumed after a long pause reusing a serialized token.

Common situations: Long-running MR/Spark jobs or notebooks holding web tokens beyond validity; validity lowered for security without clients handling re-auth; clock skew between token-issuing and token-validating nodes when a shared secret is used across services; users leaving a UI tab open overnight.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Authentication failed, URL: {}, status: {}, message: {}
• Invalid AuthenticationToken type
• tokenStr cannot be null
• url cannot be NULL
• url must be for a HTTP or HTTPS resource

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/f9e2231c2406af68. Report an issue: GitHub.