apache/hadoop · error · IOException

Cannot determine UGI from request or conf

Error message

Cannot determine UGI from request or conf

What it means

JspHelper.getDefaultWebUserName supplies the fallback web identity when security is off and the request carries no user parameter: it reads CommonConfigurationKeys.HADOOP_HTTP_STATIC_USER (hadoop.http.staticuser.user) with default 'dr.who'. If the configured value is null or empty, it throws IOException('Cannot determine UGI from request or conf') because no identity can be derived at all. Note the default is non-empty, so hitting this requires explicitly blanking the config.

Source

Thrown at hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/common/JspHelper.java:64

import static org.apache.hadoop.fs.CommonConfigurationKeys.DEFAULT_HADOOP_HTTP_STATIC_USER;
import static org.apache.hadoop.fs.CommonConfigurationKeys.HADOOP_HTTP_STATIC_USER;

@InterfaceAudience.Private
public class JspHelper {
  public static final String CURRENT_CONF = "current.conf";
  public static final String DELEGATION_PARAMETER_NAME = DelegationParam.NAME;
  public static final String NAMENODE_ADDRESS = "nnaddr";
  private static final Logger LOG = LoggerFactory.getLogger(JspHelper.class);

  /** Private constructor for preventing creating JspHelper object. */
  private JspHelper() {}

  public static String getDefaultWebUserName(Configuration conf) throws IOException {
    String user = conf.get(
        HADOOP_HTTP_STATIC_USER, DEFAULT_HADOOP_HTTP_STATIC_USER);
    if (user == null || user.length() == 0) {
      throw new IOException("Cannot determine UGI from request or conf");
    }
    return user;
  }

  private static InetSocketAddress getNNServiceAddress(ServletContext context,
      HttpServletRequest request) {
    String namenodeAddressInUrl = request.getParameter(NAMENODE_ADDRESS);
    InetSocketAddress namenodeAddress = null;
    if (namenodeAddressInUrl != null) {
      namenodeAddress = NetUtils.createSocketAddr(namenodeAddressInUrl);
    } else if (context != null) {
      namenodeAddress = NameNodeHttpServer.getNameNodeAddressFromContext(
          context); 
    }
    if (namenodeAddress != null) {
      return namenodeAddress;
    }
    return null;

View on GitHub (pinned to 2add963021)

Solutions

1. Set hadoop.http.staticuser.user to a valid, preferably unprivileged account (or remove the override to fall back to 'dr.who')
2. Alternatively pass the user explicitly: append '?user.name=<who>' to the request URL
3. Or enable Kerberos security so the authentication filter derives the user instead of the static fallback

Example fix

<!-- before -->
<property><name>hadoop.http.staticuser.user</name><value></value></property>

<!-- after -->
<property><name>hadoop.http.staticuser.user</name><value>dr.who</value></property>

String staticUser = conf.get(
    CommonConfigurationKeys.HADOOP_HTTP_STATIC_USER,
    CommonConfigurationKeys.DEFAULT_HADOOP_HTTP_STATIC_USER);
if (staticUser == null || staticUser.isEmpty()) {
  throw new IOException("hadoop.http.staticuser.user must be a non-empty username");
}
// safe to call JspHelper.getUGI for anonymous simple-auth requests

try {
  ugi = JspHelper.getUGI(context, request, conf);
} catch (IOException e) {
  if ("Cannot determine UGI from request or conf".equals(e.getMessage())) {
    resp.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR,
        "static web user misconfigured (hadoop.http.staticuser.user)");
  } else throw e;
}

When it happens

Trigger: A non-secured (simple auth) HTTP request to a NameNode/DataNode JSP or servlet that calls JspHelper.getUGI without a user.name/ugi query parameter, while hadoop.http.staticuser.user is set to an empty string or null in the effective configuration.

Common situations: Operators set the static user to '' believing it disables the fallback (it does not — it breaks JSP access); environment-specific config overlays blank the key; raw curl hits browseDirectory.jsp or a webhdfs URL with no user.name parameter after the config change.

Related errors

• Unrecognized value '{}' for dfs.http.policy
• Bad rule definition: {bad_lines}
• Security enabled but user not authenticated by filter
• Usernames not matched: expecting null but name={name}
• Cannot create directory {rootPath}

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/adfdb1f3533205da. Report an issue: GitHub.