apache/hadoop · critical · RuntimeException

Could not read signature secret file: ${signatureSecretFile}

Error message

Could not read signature secret file: ${signatureSecretFile}

What it means

While FileSignerSecretProvider streams the signature.secret.file content, any IOException (file missing, directory unreadable, permission denied) is rethrown as this RuntimeException, and provider initialization fails, preventing the webapp/filter from starting.

Source

Thrown at hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/util/FileSignerSecretProvider.java:62

        AuthenticationFilter.SIGNATURE_SECRET_FILE, null);

    if (signatureSecretFile != null) {
      try (Reader reader = new InputStreamReader(Files.newInputStream(
              Paths.get(signatureSecretFile)), StandardCharsets.UTF_8)) {
        StringBuilder sb = new StringBuilder();
        int c = reader.read();
        while (c > -1) {
          sb.append((char) c);
          c = reader.read();
        }

        secret = sb.toString().getBytes(StandardCharsets.UTF_8);
        if (secret.length == 0) {
          throw new RuntimeException("No secret in signature secret file: "
             + signatureSecretFile);
        }
      } catch (IOException ex) {
        throw new RuntimeException("Could not read signature secret file: " +
            signatureSecretFile);
      }
    }

    secrets = new byte[][]{secret};
  }

  @Override
  public byte[] getCurrentSecret() {
    return secret;
  }

  @Override
  public byte[][] getAllSecrets() {
    return secrets;
  }
}

View on GitHub (pinned to 2add963021)

Solutions

1. Verify the exact path from the config exists: 'ls -l <signature.secret.file>'
2. Grant read access to the service user ('chown' / 'chmod 640') and check parent directory traverse bits
3. If the file lives on a network mount, confirm the mount is up before starting the service

Example fix

# before
signature.secret.file=/etc/hadoop/auth-secret.pem   # file does not exist

# after: create the file with a secret and correct ownership
head -c 64 /dev/urandom | base64 > /etc/hadoop/auth-secret
chown hadoop:hadoop /etc/hadoop/auth-secret && chmod 640 /etc/hadoop/auth-secret

java.nio.file.Path p = java.nio.file.Paths.get(cfg.getProperty("signature.secret.file"));
if (!java.nio.file.Files.isReadable(p)) {
  throw new IllegalStateException("secret file not readable: " + p);
}

catch (RuntimeException e) thrown during provider init is fatal — correct the path/permissions and restart; do not catch-and-continue without a signer secret

When it happens

Trigger: signature.secret.file points to a nonexistent path; the file exists but the service user lacks read permission; the parent directory is not traversable; an NFS mount holding the file is down.

Common situations: Typo in the path inside the authentication filter config; secret file provisioned with root-only permissions; container images that omit the secrets volume.

Related errors

• No secret in signature secret file: ${signatureSecretFile}
• signer.secret.provider.zookeeper.path must be specified
• Could not read HttpFS signature secret file: {0}
• Authentication type must be specified: simple|kerberos|<clas
• CertificateException - be sure not to include PEM header and

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/a67b79cd353acf23. Report an issue: GitHub.