apache/hadoop · error · IllegalArgumentException

DtFetcher for service '{service}' does not require a token.

Error message

DtFetcher for service '{service}' does not require a token.  Check your configuration.  Note: security may be disabled or there may be two DtFetcher providers for the same service designation.

What it means

Error "DtFetcher for service '{service}' does not require a token. Check your configuration. Note: security may be disabled or there may be two DtFetcher providers for the same service designation." thrown in apache/hadoop.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/DtFileOperations.java:204

      try {
        if (!iterator.hasNext()) {
          break;
        }
        fetcher = iterator.next();
      } catch (ServiceConfigurationError | LinkageError e) {
        // failure to load a token implementation
        // log at debug and continue.
        LOG.debug("Failed to load token fetcher implementation", e);
        continue;
      }
      if (matchService(fetcher, service, url)) {
        if (!fetcher.isTokenRequired()) {
          String message = "DtFetcher for service '" + service +
              "' does not require a token.  Check your configuration.  " +
              "Note: security may be disabled or there may be two DtFetcher " +
              "providers for the same service designation.";
          LOG.error(message);
          throw new IllegalArgumentException(message);
        }
        token = fetcher.addDelegationTokens(conf, creds, renewer,
                                            stripPrefix(url));
      }
    }
    if (alias != null) {
      if (token == null) {
        String message = "DtFetcher for service '" + service + "'" +
            " does not allow aliasing.  Cannot apply alias '" + alias + "'." +
            "  Drop alias flag to get token for this service.";
        LOG.error(message);
        throw new IOException(message);
      }
      Token<?> aliasedToken = token.copyToken();
      aliasedToken.setService(alias);
      creds.addToken(alias, aliasedToken);
      LOG.info("Add token with service " + alias);
    }

View on GitHub (pinned to 2add963021)

Solutions

1. Configure a DtFetcher that returns a token for service '{service}'; the current fetcher reports no token is needed, which usually means security is disabled (hadoop.security.authentication=simple) or two DtFetcher providers are registered for the same service name.
2. Enable Kerberos security (hadoop.security.authentication=kerberos) if a delegation token is actually required, or remove the duplicate DtFetcher registration for the service.

When it happens

Trigger: Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/DtFileOperations.java:204 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/35854afd9f6f7a38. Report an issue: GitHub.