apache/hadoop · error · AccessControlException

{canceller} is not authorized to cancel the token {formatTok

Error message

{canceller} is not authorized to cancel the token {formatTokenId(id)}

What it means

Error "{canceller} is not authorized to cancel the token {formatTokenId(id)}" thrown in apache/hadoop.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/AbstractDelegationTokenSecretManager.java:757

    this.apiLock.writeLock().lock();
    try {
      ByteArrayInputStream buf = new ByteArrayInputStream(token.getIdentifier());
      DataInputStream in = new DataInputStream(buf);
      TokenIdent id = createIdentifier();
      id.readFields(in);
      LOG.info("Token cancellation requested for identifier: " + formatTokenId(id));

      if (id.getUser() == null) {
        throw new InvalidToken("Token with no owner " + formatTokenId(id));
      }
      String owner = id.getUser().getUserName();
      Text renewer = id.getRenewer();
      HadoopKerberosName cancelerKrbName = new HadoopKerberosName(canceller);
      String cancelerShortName = cancelerKrbName.getShortName();
      if (!canceller.equals(owner) &&
          (renewer == null || renewer.toString().isEmpty() ||
              !cancelerShortName.equals(renewer.toString()))) {
        throw new AccessControlException(canceller + " is not authorized to cancel the token " +
            formatTokenId(id));
      }
      DelegationTokenInformation info = currentTokens.remove(id);
      if (info == null) {
        throw new InvalidToken("Token not found " + formatTokenId(id));
      }
      METRICS.trackRemoveToken(() -> {
        removeTokenForOwnerStats(id);
        removeStoredToken(id);
      });
      return id;
    } finally {
      this.apiLock.writeLock().unlock();
    }
  }
  
  /**
   * Convert the byte[] to a secret key

View on GitHub (pinned to 2add963021)

Solutions

1. Only the token owner or the renewer may cancel token {formatTokenId(id)}. Cancel it as that principal (kinit as the owner/renewer) or have an administrator cancel it.

When it happens

Trigger: Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/AbstractDelegationTokenSecretManager.java:757 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/444938db22ba67c4. Report an issue: GitHub.