apache/hadoop · error · ServletException

Config property type doesn't exist

Error message

Config property type doesn't exist

What it means

DelegationTokenAuthenticationFilter is the HTTP auth layer for WebHDFS/KMS/HttpFS. At init it reads the standard AuthenticationFilter properties and rewrites the "type" property to the delegation-token-aware handler (simple -> PseudoDelegationTokenAuthenticationHandler, kerberos -> Kerberos..., multi-scheme -> ...). setAuthHandlerClass throws ServletException "Config property type doesn't exist" at filter initialization when the auth type property is entirely absent, which prevents the web application from starting.

Solutions

1. Set the type property under the correct prefix: hadoop.http.authentication.type=simple|kerberos|multi-scheme (or <kms/httpfs>.authentication.type for those services).
2. Confirm the config file carrying the property is loaded by the web app (core-site.xml on the NameNode/HttpFS/KMS classpath).
3. Redeploy/restart the web application so the filter re-initializes.

Example fix

<!-- before: auth configured without type -->
<property>
  <name>hadoop.http.authentication.kerberos.principal</name>
  <value>HTTP/_HOST@EXAMPLE.COM</value>
</property>
<!-- after: add the type -->
<property>
  <name>hadoop.http.authentication.type</name>
  <value>kerberos</value>
</property>

// Deploy-time check: the auth filter config must carry a type entry
String type = conf.get("hadoop.http.authentication.type");
if (type == null || !Arrays.asList("simple", "kerberos", "multi-scheme").contains(type)) {
  throw new IllegalArgumentException(
      "hadoop.http.authentication.type must be simple|kerberos|multi-scheme");
}

When it happens

Trigger: The filter config (built from the auth prefix, e.g. hadoop.http.authentication.*, dfs.web.authentication.*, hadoop.kms.authentication.*) contains no "<prefix>.type" entry, so props.getProperty(AUTH_TYPE) returns null during filter init().

Common situations: Enabling Kerberos HTTP auth but forgetting hadoop.http.authentication.type in core-site.xml; kms-site.xml missing hadoop.kms.authentication.type after an upgrade; property placed under the wrong prefix (typo) so the filter never sees it; config file not on the web app's classpath.

Related errors

• Auth ' ' not of expected form scheme:auth
• Authentication type must be specified: simple|kerberos|
• AuthenticationMethod.TOKEN + " authentication requires a…
• Can't get Kerberos realm
• : Invalid AWS credentials in required

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/cc6c724e597e04ca. Report an issue: GitHub.

Appendix: source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/web/DelegationTokenAuthenticationFilter.java:132

  @Override
  protected Properties getConfiguration(String configPrefix,
      FilterConfig filterConfig) throws ServletException {
    Properties props = super.getConfiguration(configPrefix, filterConfig);
    setAuthHandlerClass(props);
    return props;
  }

  /**
   * Set AUTH_TYPE property to the name of the corresponding authentication
   * handler class based on the input properties.
   * @param props input properties.
   * @throws ServletException servlet exception.
   */
  protected void setAuthHandlerClass(Properties props)
      throws ServletException {
    String authType = props.getProperty(AUTH_TYPE);
    if (authType == null) {
      throw new ServletException("Config property "
          + AUTH_TYPE + " doesn't exist");
    }
    if (authType.equals(PseudoAuthenticationHandler.TYPE)) {
      props.setProperty(AUTH_TYPE,
          PseudoDelegationTokenAuthenticationHandler.class.getName());
    } else if (authType.equals(KerberosAuthenticationHandler.TYPE)) {
      props.setProperty(AUTH_TYPE,
          KerberosDelegationTokenAuthenticationHandler.class.getName());
    } else if (authType.equals(MultiSchemeAuthenticationHandler.TYPE)) {
      props.setProperty(AUTH_TYPE,
          MultiSchemeDelegationTokenAuthenticationHandler.class.getName());
    }
  }

  /**
   * Returns the proxyuser configuration. All returned properties must start
   * with <code>proxyuser.</code>'
   * <p>

View on GitHub (pinned to 2add963021)