apache/hadoop · error · SecurityException

Failed to obtain current username

Error message

Failed to obtain current username

What it means

KerberosUgiAuthenticator tries Kerberos SPNEGO first and falls back to pseudo authentication when the server does not negotiate Kerberos. Its fallback asks UserGroupInformation.getLoginUser() for the user name; if that call throws IOException, it wraps the failure in a SecurityException with this message. The WebHDFS request therefore fails before it is sent.

Source

Thrown at hadoop-hdfs-project/hadoop-hdfs-client/src/main/java/org/apache/hadoop/hdfs/web/KerberosUgiAuthenticator.java:40

import org.apache.hadoop.security.UserGroupInformation;
import org.apache.hadoop.security.authentication.client.Authenticator;
import org.apache.hadoop.security.authentication.client.KerberosAuthenticator;
import org.apache.hadoop.security.authentication.client.PseudoAuthenticator;

/**
 * Use UserGroupInformation as a fallback authenticator
 * if the server does not use Kerberos SPNEGO HTTP authentication.
 */
public class KerberosUgiAuthenticator extends KerberosAuthenticator {
  @Override
  protected Authenticator getFallBackAuthenticator() {
    return new PseudoAuthenticator() {
      @Override
      protected String getUserName() {
        try {
          return UserGroupInformation.getLoginUser().getUserName();
        } catch (IOException e) {
          throw new SecurityException("Failed to obtain current username", e);
        }
      }
    };
  }
}

View on GitHub (pinned to 2add963021)

Solutions

1. If pseudo authentication is intended, set HADOOP_USER_NAME to the authorized HDFS user before JVM startup or otherwise ensure UserGroupInformation can obtain a login user.
2. If Kerberos is required, run kinit, verify UserGroupInformation.getLoginUser(), and configure the server for SPNEGO so the fallback is not used.
3. Check JAAS/keytab paths, file permissions, KDC reachability, krb5.conf, and clock skew when Kerberos login is the underlying failure.
4. Align the client and cluster security configuration so a Kerberos-enabled client does not connect to an endpoint that only supports pseudo auth.

Example fix

# before
java -cp app.jar com.example.WebHdfsJob

# after: pseudo-auth fallback has a login user
export HADOOP_USER_NAME=alice
java -cp app.jar com.example.WebHdfsJob

# or, for a Kerberos deployment
kinit alice@EXAMPLE.COM && java -cp app.jar com.example.WebHdfsJob

try {
  UserGroupInformation login = UserGroupInformation.getLoginUser();
  LOG.info("WebHDFS login user: {}", login.getUserName());
} catch (IOException e) {
  throw new IllegalStateException("Cannot establish a Hadoop login user; run kinit or set HADOOP_USER_NAME", e);
}

try {
  return fs.open(path);
} catch (SecurityException e) {
  if ("Failed to obtain current username".equals(e.getMessage())) {
    throw new SecurityException("WebHDFS pseudo-auth fallback could not obtain a Hadoop login user", e);
  }
  throw e;
} catch (IOException e) {
  if (e.getCause() instanceof SecurityException) {
    throw (SecurityException) e.getCause();
  }
  throw e;
}

When it happens

Trigger: A WebHDFS server responds without SPNEGO negotiation, causing PseudoAuthenticator fallback, while UserGroupInformation cannot establish a login user. Concrete triggers include no Kerberos ticket, no HADOOP_USER_NAME override, an unreadable JAAS/keytab configuration, or an OS user lookup failure.

Common situations: Running a job on a host without kinit; a container without HADOOP_USER_NAME; a partially Kerberos-enabled cluster where the client is secure but the WebHDFS endpoint is not; incorrect KRB5_CONFIG, JAAS file permissions, or JDK Kerberos settings.

Related errors

• Access denied: dfs.http.policy is HTTPS_ONLY.
• Server asks us to fall back to SIMPLE auth, but this client
• Can't get Kerberos realm
• Failed to obtain user group information: {}
• The length to read ${length} exceeds the file length ${fin.l

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/962510dfdf9204c6. Report an issue: GitHub.