apache/hadoop · error · AuthorizationException

Host {} is not authorized for protocol {}

Error message

Host {} is not authorized for protocol {}

What it means

ServiceAuthorizationManager.authorize throws AuthorizationException at the host level: the client InetAddress is not accepted for the protocol because the host ACL pair is malformed (hosts.length != 2), the address is not in the allow MachineList (hosts[0]), or it is in the block list (hosts[1]). This fires after the user ACL check passed, when addr is non-null.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/authorize/ServiceAuthorizationManager.java:133

    }
    if((clientPrincipal != null && !clientPrincipal.equals(user.getUserName())) || 
       acls.length != 2  || !acls[0].isUserAllowed(user) || acls[1].isUserAllowed(user)) {
      String cause = clientPrincipal != null ?
          ": this service is only accessible by " + clientPrincipal :
          ": denied by configured ACL";
      AUDITLOG.warn(AUTHZ_FAILED_FOR + user
          + " for protocol=" + protocol + cause);
      throw new AuthorizationException("User " + user +
          " is not authorized for protocol " + protocol + cause);
    }
    if (addr != null) {
      String hostAddress = addr.getHostAddress();
      if (hosts.length != 2 || !hosts[0].includes(hostAddress) ||
          hosts[1].includes(hostAddress)) {
        AUDITLOG.warn(AUTHZ_FAILED_FOR + " for protocol=" + protocol
            + " from host = " +  hostAddress);
        throw new AuthorizationException("Host " + hostAddress +
            " is not authorized for protocol " + protocol) ;
      }
    }
    AUDITLOG.info(AUTHZ_SUCCESSFUL_FOR + user + " for protocol="+protocol);
  }

  public void refresh(Configuration conf,
                                          PolicyProvider provider) {
    // Get the system property 'hadoop.policy.file'
    String policyFile = 
      System.getProperty("hadoop.policy.file", HADOOP_POLICY_FILE);
    
    // Make a copy of the original config, and load the policy file
    Configuration policyConf = new Configuration(conf);
    policyConf.addResource(policyFile);
    refreshWithLoadedConfiguration(policyConf, provider);
  }

View on GitHub (pinned to 2add963021)

Solutions

1. Add the denied host address (from the message) or its subnet to security.<protocol>.hosts in hadoop-policy.xml
2. Remove the address from security.<protocol>.hosts.blocked if it is denied there
3. Refresh service ACLs on the servers (dfsadmin -refreshServiceAcl / rmadmin -refreshServiceAcl) after editing
4. Prefer full ACL pairs (allow plus block) in policy edits so hosts.length stays 2

Example fix

<!-- hadoop-policy.xml: before -->
<property>
  <name>security.client.protocol.hosts</name>
  <value>10.0.0.0/24</value>
</property>
<!-- client at 10.0.5.20 denied -->

<!-- after -->
<property>
  <name>security.client.protocol.hosts</name>
  <value>10.0.0.0/24,10.0.5.20</value>
</property>

// client-side preflight: warn if the local address is outside the protocol host allow list
String allow = policy.get("security." + protocolKey + ".hosts");
if (allow != null && !new MachineList(allow).includes(localAddr)) {
  LOG.warn("Local address {} not in {} allow list; call will be denied", localAddr, protocolKey);
}

try {
  ServiceAuthorizationManager.authorize(user, protocol, conf, addr);
} catch (AuthorizationException e) {
  if (e.getMessage().startsWith("Host ")) {
    // host ACL denial: fix security.<protocol>.hosts / .hosts.blocked
  }
  throw e;
}

When it happens

Trigger: A client from an IP not covered by security.<protocol>.hosts (allow list), or listed in security.<protocol>.hosts.blocked, connecting over RPC with service authorization enabled.

Common situations: Tightening hadoop-policy.xml with host ACLs (e.g. security.client.protocol.hosts) and forgetting a subnet; machines added to the cluster but not to the allow list; blocked-list entries that accidentally match broad ranges.

Related errors

• User {} is not authorized for protocol {}: {}
• Protocol {} is not known.
• Null protocol not authorized
• hadoop.security.authorizationis configured to true but servi
• User {} can not be added

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/9d5fc3b89b182fe8. Report an issue: GitHub.