apache/hadoop · error · RuntimeException

Could not Load ZK acls or auth: {ex}

Error message

Could not Load ZK acls or auth: {ex}

What it means

Error "Could not Load ZK acls or auth: {ex}" thrown in apache/hadoop.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/ZKDelegationTokenSecretManager.java:237

      return ZookeeperClient.configure()
          .withConnectionString(connString)
          .withNamespace(namespace)
          .withZookeeperFactory(zkFactory)
          .withAuthType(authType)
          .withKeytab(keytab)
          .withPrincipal(principal)
          .withJaasLoginEntryName(JAAS_LOGIN_ENTRY_NAME)
          .withRetryPolicy(retryPolicy)
          .withSessionTimeout(sessionTimeout)
          .withConnectionTimeout(connectionTimeout)
          .enableSSL(isSSLEnabled)
          .withKeystore(keystoreLocation)
          .withKeystorePassword(keystorePassword)
          .withTruststore(truststoreLocation)
          .withTruststorePassword(truststorePassword)
          .create();
    } catch (Exception ex) {
      throw new RuntimeException("Could not Load ZK acls or auth: " + ex, ex);
    }
  }

  @Override
  public void startThreads() throws IOException {
    if (!isExternalClient) {
      try {
        zkClient.start();
      } catch (Exception e) {
        throw new IOException("Could not start Curator Framework", e);
      }
    } else {
      // If namespace parents are implicitly created, they won't have ACLs.
      // So, let's explicitly create them.
      CuratorFramework nullNsFw = zkClient.usingNamespace(null);
      try {
        String nameSpace = "/" + zkClient.getNamespace();
        nullNsFw.create().creatingParentContainersIfNeeded().forPath(nameSpace);

View on GitHub (pinned to 2add963021)

Solutions

1. ZooKeeper ACL/auth configuration could not be parsed. Check hadoop.zk.acl and hadoop.zk.auth values: ACLs must be 'scheme:id:perm' and auths 'scheme:auth'. Underlying error: {ex}.

When it happens

Trigger: Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/ZKDelegationTokenSecretManager.java:237 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/a218a92cde890df4. Report an issue: GitHub.