apache/hadoop · error · IllegalArgumentException

Invalid attribute value for hadoop.security.authentication o

Error message

Invalid attribute value for hadoop.security.authentication of 

What it means

SecurityUtil.getAuthenticationMethod reads hadoop.security.authentication (default 'simple'), upper-cases it, and maps it onto the AuthenticationMethod enum. Any value that is not an enum constant throws IllegalArgumentException. Only simple and kerberos are normal user-facing settings; token/proxy are framework-internal.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SecurityUtil.java:796

    }

    // implemented as a separate method to facilitate unit testing
    InetAddress getInetAddressByName(String host) throws UnknownHostException {
      return InetAddress.getByName(host);
    }

    void setSearchDomains(String ... domains) {
      searchDomains = Arrays.asList(domains);
    }
  }

  public static AuthenticationMethod getAuthenticationMethod(Configuration conf) {
    String value = conf.get(HADOOP_SECURITY_AUTHENTICATION, "simple");
    try {
      return Enum.valueOf(AuthenticationMethod.class,
          StringUtils.toUpperCase(value));
    } catch (IllegalArgumentException iae) {
      throw new IllegalArgumentException("Invalid attribute value for " +
          HADOOP_SECURITY_AUTHENTICATION + " of " + value);
    }
  }

  public static void setAuthenticationMethod(
      AuthenticationMethod authenticationMethod, Configuration conf) {
    if (authenticationMethod == null) {
      authenticationMethod = AuthenticationMethod.SIMPLE;
    }
    conf.set(HADOOP_SECURITY_AUTHENTICATION,
        StringUtils.toLowerCase(authenticationMethod.toString()));
  }

  /*
   * Check if a given port is privileged.
   * The ports with number smaller than 1024 are treated as privileged ports in
   * unix/linux system. For other operating systems, use this method with care.
   * For example, Windows doesn't have the concept of privileged ports.

View on GitHub (pinned to 2add963021)

Solutions

1. Set hadoop.security.authentication to simple or kerberos
2. Strip whitespace and newlines from the property value in the XML
3. Dump the effective config (e.g. 'hadoop conf' or a Configuration.dumpConfiguration snippet) to find which file supplies the bad value
4. Add a pre-flight validation step that parses the value against AuthenticationMethod.valueOf before shipping configs

Example fix

<!-- before -->
<property><name>hadoop.security.authentication</name><value>LDAP</value></property>

<!-- after -->
<property><name>hadoop.security.authentication</name><value>kerberos</value></property>

Set<String> ALLOWED = new HashSet<>(Arrays.asList("simple", "kerberos"));
String auth = conf.get("hadoop.security.authentication", "simple").trim();
if (!ALLOWED.contains(auth)) {
  throw new IllegalArgumentException(
      "hadoop.security.authentication must be one of " + ALLOWED + ", got: '" + auth + "'");
}

static boolean isValidAuthenticationMethod(String value) {
  try {
    Enum.valueOf(AuthenticationMethod.class, value.trim().toUpperCase(Locale.ROOT));
    return true;
  } catch (IllegalArgumentException e) {
    return false;
  }
}

When it happens

Trigger: core-site.xml (or a config override chain) sets hadoop.security.authentication to a non-enum value: 'ldap', 'AD', a typo like 'kerboros', or a value with stray whitespace/newline that survives conf.get (Enum.valueOf fails on the untrimmed upper-cased string).

Common situations: Operators try to name an SSO/LDOPA scheme directly in the property, template engines inject trailing whitespace, or a later *-site.xml on the classpath overrides the intended value.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• No COS Credential Providers
• No COS Credentials provided by %s
• Missing keyfile property ('%s') for authentication type '%s'
• Unknown authentication type: %s
• No secret in signature secret file: ${signatureSecretFile}

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/b439d1dab8dc5cd7. Report an issue: GitHub.