apache/hadoop · error · IOException

Can't add persisted delegation token to a running SecretMana

Error message

Can't add persisted delegation token to a running SecretManager.

What it means

Error "Can't add persisted delegation token to a running SecretManager." thrown in apache/hadoop.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/AbstractDelegationTokenSecretManager.java:459

    currentTokens.put(ident, tokenInfo);
    updateStoredToken(ident, tokenInfo.getRenewDate());
  }

  /**
   * This method is intended to be used for recovering persisted delegation
   * tokens. Tokens that have an unknown <code>DelegationKey</code> are
   * marked as expired and automatically cleaned up.
   * This method must be called before this secret manager is activated (before
   * startThreads() is called)
   * @param identifier identifier read from persistent storage
   * @param renewDate token renew time
   * @throws IOException raised on errors performing I/O.
   */
  public void addPersistedDelegationToken(
      TokenIdent identifier, long renewDate) throws IOException {
    if (running) {
      // a safety check
      throw new IOException(
          "Can't add persisted delegation token to a running SecretManager.");
    }
    this.apiLock.writeLock().lock();
    try {
      int keyId = identifier.getMasterKeyId();
      DelegationKey dKey = allKeys.get(keyId);
      byte[] password = null;
      if (dKey == null) {
        LOG.warn("No KEY found for persisted identifier, expiring stored token " + formatTokenId(
            identifier));
        // make sure the token is expired
        renewDate = 0L;
      } else {
        password = createPassword(identifier.getBytes(), dKey.getKey());
      }
      if (identifier.getSequenceNumber() > getDelegationTokenSeqNum()) {
        setDelegationTokenSeqNum(identifier.getSequenceNumber());
      }

View on GitHub (pinned to 2add963021)

Solutions

1. Load persisted tokens during recovery (loadFromStore) before the SecretManager starts its threads. Restart the service so stored tokens are loaded at startup instead of after it is running.

When it happens

Trigger: Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/AbstractDelegationTokenSecretManager.java:459 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/6eedad7da6f47c2d. Report an issue: GitHub.