apache/hadoop · error · IllegalArgumentException

Invalid attribute value for hadoop.kerberos.min.seconds.befo

Error message

Invalid attribute value for hadoop.kerberos.min.seconds.before.relogin of " + conf.get(HADOOP_KERBEROS_MIN_SECONDS_BEFORE_RELOGIN)

What it means

During UGI static initialization the value of hadoop.kerberos.min.seconds.before.relogin is read with Configuration.getLong (default 60). A non-numeric value raises NumberFormatException, rethrown as IllegalArgumentException naming the key and the raw configured value.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/UserGroupInformation.java:326

   */
  private static synchronized void initialize(Configuration conf,
                                              boolean overrideNameRules) {
    authenticationMethod = SecurityUtil.getAuthenticationMethod(conf);
    if (overrideNameRules || !HadoopKerberosName.hasRulesBeenSet()) {
      try {
        HadoopKerberosName.setConfiguration(conf);
      } catch (IOException ioe) {
        throw new RuntimeException(
            "Problem with Kerberos auth_to_local name configuration", ioe);
      }
    }
    try {
        kerberosMinSecondsBeforeRelogin = 1000L * conf.getLong(
                HADOOP_KERBEROS_MIN_SECONDS_BEFORE_RELOGIN,
                HADOOP_KERBEROS_MIN_SECONDS_BEFORE_RELOGIN_DEFAULT);
    }
    catch(NumberFormatException nfe) {
        throw new IllegalArgumentException("Invalid attribute value for " +
                HADOOP_KERBEROS_MIN_SECONDS_BEFORE_RELOGIN + " of " +
                conf.get(HADOOP_KERBEROS_MIN_SECONDS_BEFORE_RELOGIN));
    }

    kerberosKeyTabLoginRenewalEnabled = conf.getBoolean(
            HADOOP_KERBEROS_KEYTAB_LOGIN_AUTORENEWAL_ENABLED,
            HADOOP_KERBEROS_KEYTAB_LOGIN_AUTORENEWAL_ENABLED_DEFAULT);

    // If we haven't set up testing groups, use the configuration to find it
    if (!(groups instanceof TestingGroups)) {
      groups = Groups.getUserToGroupsMappingService(conf);
    }
    UserGroupInformation.conf = conf;

    if (metrics.getGroupsQuantiles == null) {
      int[] intervals = conf.getInts(HADOOP_USER_GROUP_METRICS_PERCENTILES_INTERVALS);
      if (intervals != null && intervals.length > 0) {
        final int length = intervals.length;

View on GitHub (pinned to 2add963021)

Solutions

1. Set the property to a plain integer, e.g. <value>60</value>
2. Remove the property entirely to accept the default of 60 seconds
3. Search the full config chain (core-site.xml, _override, cluster management overlays) for a duplicated key holding the bad value

Example fix

<!-- before -->
<property>
  <name>hadoop.kerberos.min.seconds.before.relogin</name>
  <value>60s</value>
</property>
<!-- after -->
<property>
  <name>hadoop.kerberos.min.seconds.before.relogin</name>
  <value>60</value>
</property>

String v = conf.get("hadoop.kerberos.min.seconds.before.relogin");
if (v != null && !v.matches("\\d+")) {
  throw new IllegalArgumentException(
      "hadoop.kerberos.min.seconds.before.relogin must be an integer, got: " + v);
}

When it happens

Trigger: core-site.xml sets hadoop.kerberos.min.seconds.before.relogin to a non-integer (e.g. '60s', '1,000', or an empty tag) and any code path touches UserGroupInformation initialization.

Common situations: Copy-pasted configuration with units appended; property left empty by templating; YAML-to-XML conversion writing a boolean or float.

Related errors

• Problem with Kerberos auth_to_local name configuration
• login must be done first
• Server asks us to fall back to SIMPLE auth, but this client
• Can't get Kerberos realm
• Illegal principal name " + name + ": " + ioe.toString()

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/1732c4fabe59921a. Report an issue: GitHub.