apache/hadoop · error · IOException

Delegation Token can be renewed only with kerberos or web au

Error message

Delegation Token can be renewed only with kerberos or web authentication

What it means

RouterSecurityManager.renewDelegationToken applies the same guard as token issuance: isAllowedDelegationTokenOp() must be true, i.e. security enabled and the connection authenticated as KERBEROS, KERBEROS_SSL, or CERTIFICATE (PROXY unwrapped to its real user). A token cannot be renewed over a weakly-authenticated connection; the IOException aborts the renew before dtSecretManager.renewToken is reached.

Source

Thrown at hadoop-hdfs-project/hadoop-hdfs-rbf/src/main/java/org/apache/hadoop/hdfs/server/federation/router/security/RouterSecurityManager.java:175

    return token;
  }

  /**
   * @param token token to renew
   * @return new expiryTime of the token
   * @throws SecretManager.InvalidToken if {@code token} is invalid
   * @throws IOException on errors
   */
  public long renewDelegationToken(Token<DelegationTokenIdentifier> token)
          throws SecretManager.InvalidToken, IOException {
    LOG.debug("Renew delegation token");
    final String operationName = "renewDelegationToken";
    boolean success = false;
    String tokenId = "";
    long expiryTime;
    try {
      if (!isAllowedDelegationTokenOp()) {
        throw new IOException(
            "Delegation Token can be renewed only " +
                "with kerberos or web authentication");
      }
      String renewer = getRemoteUser().getShortUserName();
      expiryTime = dtSecretManager.renewToken(token, renewer);
      final DelegationTokenIdentifier id = DFSUtil.decodeDelegationToken(token);
      tokenId = id.toStringStable();
      success = true;
    } catch (AccessControlException ace) {
      final DelegationTokenIdentifier id = DFSUtil.decodeDelegationToken(token);
      tokenId = id.toStringStable();
      throw ace;
    } finally {
      logAuditEvent(success, operationName, tokenId);
    }
    return expiryTime;
  }

View on GitHub (pinned to 2add963021)

Solutions

1. Run the renewer under kerberos: kinit or UserGroupInformation.loginUserFromKeytab before renewDelegationToken, so the connection is KERBEROS-authenticated.
2. Renew tokens from the kerberos-authenticated job client (as designed), not from a session that only holds the delegation token.
3. Verify proxy real-user authentication is kerberos when renewing on behalf of another user.
4. Check that the Router's dtSecretManager is running (the next guard logs 'trying to get DT with no secret manager running') — fix dfs.federation.router.delegation-token.driver-class if so.

Example fix

// before: renewing over a token-authenticated (DIGEST) session
fs.renewDelegationToken(token); // throws

// after: renew from a kerberos-authenticated context
UserGroupInformation.loginUserFromKeytab("renewer@REALM", "/etc/security/keytabs/renewer.keytab");
UserGroupInformation.getLoginUser().doAs((PrivilegedExceptionAction<Long>) () -> token.renew(conf));

// Renewal must come from a kerberos-authenticated context
UserGroupInformation ugi = UserGroupInformation.getLoginUser();
if (UserGroupInformation.isSecurityEnabled()
    && ugi.getAuthenticationMethod() != UserGroupInformation.AuthenticationMethod.KERBEROS) {
  throw new IllegalStateException("Token renewal requires kerberos auth; re-kinit");
}

try {
  long expiry = token.renew(conf);
} catch (IOException e) {
  if (e.getMessage() != null && e.getMessage().contains("Delegation Token can be renewed only")) {
    // re-establish kerberos and retry once
    UserGroupInformation.loginUserFromKeytab(principal, keytab);
    expiry = token.renew(conf);
  } else {
    throw e;
  }
}

When it happens

Trigger: Calling renewDelegationToken without kerberos: client session established with a delegation token (DIGEST) instead of kerberos; unauthenticated (SIMPLE) client on a secured router; proxy user whose real user is not kerberos-authenticated.

Common situations: Long-running job tries to renew its own DT using the DT-authenticated FileSystem; cron/renewer service forgot to kinit; mixing secured router with a client whose core-site still says simple.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Delegation Token can be issued only with kerberos or web aut
• Failed to create SecretManager
• Fetch of delegation token failed
• Security enabled but user not authenticated by filter
• {} parameter is not null.

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/880b1fb910ab77ed. Report an issue: GitHub.