apache/hadoop · critical · RuntimeException

Could not read HttpFS signature secret file: {0}

Error message

Could not read HttpFS signature secret file: {0}

What it means

HttpFSAuthenticationFilter opens the file given by httpfs.authentication.signature.secret.file to load the cookie-signing secret. If opening or reading it throws IOException (file deleted, unreadable permissions, path is a directory), init wraps it as RuntimeException('Could not read HttpFS signature secret file: <path>') and the webapp fails to start.

Source

Thrown at hadoop-hdfs-project/hadoop-hdfs-httpfs/src/main/java/org/apache/hadoop/fs/http/server/HttpFSAuthenticationFilter.java:105

          Paths.get(signatureSecretFile)), StandardCharsets.UTF_8)) {
        StringBuilder secret = new StringBuilder();
        int c = reader.read();
        while (c > -1) {
          secret.append((char) c);
          c = reader.read();
        }

        String secretString = secret.toString();
        if (secretString.isEmpty()) {
          throw new RuntimeException(
              "No secret in HttpFs signature secret file: "
                  + signatureSecretFile);
        }

        props.setProperty(AuthenticationFilter.SIGNATURE_SECRET,
            secretString);
      } catch (IOException ex) {
        throw new RuntimeException("Could not read HttpFS signature "
            + "secret file: " + signatureSecretFile);
      }
    }
    setAuthHandlerClass(props);
    String dtkind = WebHdfsConstants.WEBHDFS_TOKEN_KIND.toString();
    if (conf.getBoolean(HttpFSServerWebServer.SSL_ENABLED_KEY, false)) {
      dtkind = WebHdfsConstants.SWEBHDFS_TOKEN_KIND.toString();
    }
    props.setProperty(KerberosDelegationTokenAuthenticationHandler.TOKEN_KIND,
                      dtkind);
    return props;
  }

  protected Configuration getProxyuserConfiguration(FilterConfig filterConfig) {
    Map<String, String> proxyuserConf = HttpFSServerWebApp.get().getConfig().
        getValByRegex("httpfs\\.proxyuser\\.");
    Configuration conf = new Configuration(false);
    for (Map.Entry<String, String> entry : proxyuserConf.entrySet()) {

View on GitHub (pinned to 2add963021)

Solutions

1. Verify the exact path from the message exists and is a regular file: ls -l <path>.
2. Grant read access to the httpfs run user: chown httpfs <path>; chmod 400 <path> (or appropriate ACL).
3. Restart HttpFS after the fix; if using containers, ensure the secret volume is mounted before the JVM starts.

Example fix

# before
$ ls -l /etc/hadoop/security/httpfs-signature-secret
-rw------- 1 root root 32 ... # httpfs user cannot read

# after
$ chown httpfs:hadoop /etc/hadoop/security/httpfs-signature-secret
$ chmod 400 /etc/hadoop/security/httpfs-signature-secret
$ systemctl restart httpfs

# verify readable by the daemon user before start
SECRET=/etc/hadoop/security/httpfs-signature-secret
sudo -u httpfs test -r "$SECRET" || { echo "FATAL: $SECRET not readable by httpfs"; exit 1; }

When it happens

Trigger: The secret file was present at configure time but removed before/at startup; the httpfs daemon user lacks read permission (file owned by root with mode 600); the path points to a directory or a symlink whose target is gone; NFS/Kerberos-protected mount not mounted when HttpFS starts.

Common situations: Secrets distributed to only some nodes of an HttpFS HA pair; file created as root during manual install and never chowned; containers where the secret volume is mounted after process start; SELinux denying the read (manifests as IOException).

Related errors

• Undefined property: signature.secret.file
• No secret in HttpFs signature secret file: {0}
• Could not read signature secret file: ${signatureSecretFile}
• S06
• Authentication type must be specified: simple|kerberos|<clas

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/baaa3649ec621236. Report an issue: GitHub.