apache/hadoop · error · HadoopIllegalArgumentException

hadoop.security.authorizationis configured to true but servi

Error message

hadoop.security.authorizationis configured to true but service-levelauthorization security policy is null.

What it means

ZKFCRpcServer's constructor throws HadoopIllegalArgumentException when hadoop.security.authorization is true but the PolicyProvider passed to the constructor is null, so server.refreshServiceAcl(conf, policy) cannot be called. It is a wiring error in how the ZKFC RPC server was constructed, not a normal runtime condition.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/ha/ZKFCRpcServer.java:68

      PolicyProvider policy) throws IOException {
    this.zkfc = zkfc;
    
    RPC.setProtocolEngine(conf, ZKFCProtocolPB.class,
        ProtobufRpcEngine2.class);
    ZKFCProtocolServerSideTranslatorPB translator =
        new ZKFCProtocolServerSideTranslatorPB(this);
    BlockingService service = ZKFCProtocolService
        .newReflectiveBlockingService(translator);
    this.server = new RPC.Builder(conf).setProtocol(ZKFCProtocolPB.class)
        .setInstance(service).setBindAddress(bindAddr.getHostName())
        .setPort(bindAddr.getPort()).setNumHandlers(HANDLER_COUNT)
        .setVerbose(false).build();
    
    // set service-level authorization security policy
    if (conf.getBoolean(
        CommonConfigurationKeys.HADOOP_SECURITY_AUTHORIZATION, false)) {
      if (policy == null) {
        throw new HadoopIllegalArgumentException(
            CommonConfigurationKeys.HADOOP_SECURITY_AUTHORIZATION
                + "is configured to true but service-level"
                + "authorization security policy is null.");
      }
      server.refreshServiceAcl(conf, policy);
    }

  }
  
  void start() {
    this.server.start();
  }

  public InetSocketAddress getAddress() {
    return server.getListenerAddress();
  }

  void stopAndJoin() throws InterruptedException {

View on GitHub (pinned to 2add963021)

Solutions

1. Pass a PolicyProvider when authorization is enabled — Hadoop wires its own (ZKFCPolicyProvider) in the normal daemon path; don't construct the server manually.
2. Or set hadoop.security.authorization=false in that Configuration if service-level ACLs are not intended for that server.
3. If embedding is required, construct with a non-null policy or a Configuration with authorization disabled before calling the constructor.

Example fix

// before
new ZKFCRpcServer(conf, myAddr, null);

// after: supply the policy when hadoop.security.authorization=true
new ZKFCRpcServer(conf, myAddr, new ZKFCPolicyProvider());
// or disable service ACLs for this embedded server
conf.setBoolean(CommonConfigurationKeys.HADOOP_SECURITY_AUTHORIZATION, false);

boolean authz = conf.getBoolean(
    CommonConfigurationKeys.HADOOP_SECURITY_AUTHORIZATION, false);
if (authz && policy == null) {
  throw new IllegalStateException(
      "hadoop.security.authorization=true requires a non-null PolicyProvider");
}
new ZKFCRpcServer(conf, addr, authz ? policy : null);

try {
  new ZKFCRpcServer(conf, addr, policy);
} catch (HadoopIllegalArgumentException e) {
  // pass a PolicyProvider (e.g. ZKFCPolicyProvider) or disable
  // hadoop.security.authorization for this embedded server
}

When it happens

Trigger: Constructing new ZKFCRpcServer(conf, addr, null) while HADOOP_SECURITY_AUTHORIZATION is true in the Configuration; any code path or test harness that instantiates the server without supplying a service-ACL policy provider.

Common situations: Custom tooling embedding ZKFCRpcServer directly; unit tests with authorization on but no policy; running against a mixed-version classpath where the caller does not pass the ZKFCPolicyProvider.

Related errors

• Bad argument: {}
• ZK Failover Controller failed: {}
• Couldn't transition to active
• Unable to fence {}
• Null protocol not authorized

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/a4c0a31f978e2b1d. Report an issue: GitHub.