apache/hadoop · error · AccessControlException

Can't continue with getBlockLocalPathInfo() authorization. T

Error message

Can't continue with getBlockLocalPathInfo() authorization. The user {} is not configured in dfs.block.local-path-access.user

What it means

Error "Can't continue with getBlockLocalPathInfo() authorization. The user {} is not configured in dfs.block.local-path-access.user" thrown in apache/hadoop.

Source

Thrown at hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/datanode/DataNode.java:2429

  /** Ensure the authentication method is kerberos */
  private void checkKerberosAuthMethod(String msg) throws IOException {
    // User invoking the call must be same as the datanode user
    if (!UserGroupInformation.isSecurityEnabled()) {
      return;
    }
    if (UserGroupInformation.getCurrentUser().getAuthenticationMethod() != 
        AuthenticationMethod.KERBEROS) {
      throw new AccessControlException("Error in " + msg
          + "Only kerberos based authentication is allowed.");
    }
  }
  
  private void checkBlockLocalPathAccess() throws IOException {
    checkKerberosAuthMethod("getBlockLocalPathInfo()");
    String currentUser = UserGroupInformation.getCurrentUser().getShortUserName();
    if (!usersWithLocalPathAccess.contains(currentUser)) {
      throw new AccessControlException(
          "Can't continue with getBlockLocalPathInfo() "
              + "authorization. The user " + currentUser
              + " is not configured in "
              + DFSConfigKeys.DFS_BLOCK_LOCAL_PATH_ACCESS_USER_KEY);
    }
  }

  public long getMaxNumberOfBlocksToLog() {
    return maxNumberOfBlocksToLog;
  }

  @Override
  public BlockLocalPathInfo getBlockLocalPathInfo(ExtendedBlock block,
      Token<BlockTokenIdentifier> token) throws IOException {
    checkBlockLocalPathAccess();
    checkBlockToken(block, token, BlockTokenIdentifier.AccessMode.READ);
    checkStorageState("getBlockLocalPathInfo");
    BlockLocalPathInfo info = data.getBlockLocalPathInfo(block);

View on GitHub (pinned to 2add963021)

Solutions

1. Add the user to dfs.block.local-path-access.user in hdfs-site.xml and restart/refresh the DataNode.
2. Alternatively, disable short-circuit local reads (dfs.client.read.shortcircuit=false) on the client so it reads over the standard DataTransferProtocol.

When it happens

Trigger: A client attempts getBlockLocalPathInfo (short-circuit read) as a user not listed in dfs.block.local-path-access.user.

Common situations: A user requested short-circuit local block paths without being listed in dfs.block.local-path-access.user. Add the user to that config on the DataNode.

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/ed3f66dbf9b078c6. Report an issue: GitHub.