apache/hadoop · error · ServletException

Config property type doesn't exist

Error message

Config property type doesn't exist

What it means

DelegationTokenAuthenticationFilter is the HTTP auth layer for WebHDFS/KMS/HttpFS. At init it reads the standard AuthenticationFilter properties and rewrites the "type" property to the delegation-token-aware handler (simple -> PseudoDelegationTokenAuthenticationHandler, kerberos -> Kerberos..., multi-scheme -> ...). setAuthHandlerClass throws ServletException "Config property type doesn't exist" at filter initialization when the auth type property is entirely absent, which prevents the web application from starting.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/web/DelegationTokenAuthenticationFilter.java:132

  @Override
  protected Properties getConfiguration(String configPrefix,
      FilterConfig filterConfig) throws ServletException {
    Properties props = super.getConfiguration(configPrefix, filterConfig);
    setAuthHandlerClass(props);
    return props;
  }

  /**
   * Set AUTH_TYPE property to the name of the corresponding authentication
   * handler class based on the input properties.
   * @param props input properties.
   * @throws ServletException servlet exception.
   */
  protected void setAuthHandlerClass(Properties props)
      throws ServletException {
    String authType = props.getProperty(AUTH_TYPE);
    if (authType == null) {
      throw new ServletException("Config property "
          + AUTH_TYPE + " doesn't exist");
    }
    if (authType.equals(PseudoAuthenticationHandler.TYPE)) {
      props.setProperty(AUTH_TYPE,
          PseudoDelegationTokenAuthenticationHandler.class.getName());
    } else if (authType.equals(KerberosAuthenticationHandler.TYPE)) {
      props.setProperty(AUTH_TYPE,
          KerberosDelegationTokenAuthenticationHandler.class.getName());
    } else if (authType.equals(MultiSchemeAuthenticationHandler.TYPE)) {
      props.setProperty(AUTH_TYPE,
          MultiSchemeDelegationTokenAuthenticationHandler.class.getName());
    }
  }

  /**
   * Returns the proxyuser configuration. All returned properties must start
   * with <code>proxyuser.</code>'
   * <p>

View on GitHub (pinned to 2add963021)

Solutions

1. Set the type property under the correct prefix: hadoop.http.authentication.type=simple|kerberos|multi-scheme (or <kms/httpfs>.authentication.type for those services).
2. Confirm the config file carrying the property is loaded by the web app (core-site.xml on the NameNode/HttpFS/KMS classpath).
3. Redeploy/restart the web application so the filter re-initializes.

Example fix

<!-- before: auth configured without type -->
<property>
  <name>hadoop.http.authentication.kerberos.principal</name>
  <value>HTTP/_HOST@EXAMPLE.COM</value>
</property>
<!-- after: add the type -->
<property>
  <name>hadoop.http.authentication.type</name>
  <value>kerberos</value>
</property>

// Deploy-time check: the auth filter config must carry a type entry
String type = conf.get("hadoop.http.authentication.type");
if (type == null || !Arrays.asList("simple", "kerberos", "multi-scheme").contains(type)) {
  throw new IllegalArgumentException(
      "hadoop.http.authentication.type must be simple|kerberos|multi-scheme");
}

When it happens

Trigger: The filter config (built from the auth prefix, e.g. hadoop.http.authentication.*, dfs.web.authentication.*, hadoop.kms.authentication.*) contains no "<prefix>.type" entry, so props.getProperty(AUTH_TYPE) returns null during filter init().

Common situations: Enabling Kerberos HTTP auth but forgetting hadoop.http.authentication.type in core-site.xml; kms-site.xml missing hadoop.kms.authentication.type after an upgrade; property placed under the wrong prefix (typo) so the filter never sees it; config file not on the web app's classpath.

Related errors

• No COS Credential Providers
• No COS Credentials provided by %s
• Missing keyfile property ('%s') for authentication type '%s'
• Unknown authentication type: %s
• Authentication type must be specified: simple|kerberos|<clas

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/cc6c724e597e04ca. Report an issue: GitHub.