apache/hadoop · error · AuthenticationException

Invalid token string, missing attributes

Error message

Invalid token string, missing attributes

What it means

AuthToken.parse() decodes the wire form of a hadoop-auth signed authentication token ('u=<user>&p=<principal>&t=<type>&e=<expires>[&i=<maxInactives>]&s=<signature>'). The signature pair 's' is intentionally removed, but the four attributes u, p, t and e are mandatory. If the key/value map produced by split() lacks any of them, this AuthenticationException is thrown.

Source

Thrown at hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/util/AuthToken.java:214

  @Override
  public String toString() {
    return tokenStr;
  }

  public static AuthToken parse(String tokenStr) throws AuthenticationException {
    if (tokenStr.length() >= 2) {
      // strip the \" at the two ends of the tokenStr
      if (tokenStr.charAt(0) == '\"' &&
          tokenStr.charAt(tokenStr.length()-1) == '\"') {
        tokenStr = tokenStr.substring(1, tokenStr.length()-1);
      }
    } 
    Map<String, String> map = split(tokenStr);
    // remove the signature part, since client doesn't care about it
    map.remove("s");

    if (!map.keySet().containsAll(ATTRIBUTES)) {
      throw new AuthenticationException("Invalid token string, missing attributes");
    }
    long expires = Long.parseLong(map.get(EXPIRES));
    AuthToken token = new AuthToken(map.get(USER_NAME), map.get(PRINCIPAL), map.get(TYPE));
    //process optional attributes
    if (map.containsKey(MAX_INACTIVES)) {
      long maxInactives = Long.parseLong(map.get(MAX_INACTIVES));
      token.setMaxInactives(maxInactives);
    }
    token.setExpires(expires);
    return token;
  }

  /**
   * Splits the string representation of a token into attributes pairs.
   *
   * @param tokenStr string representation of a token.
   *
   * @return a map with the attribute pairs of the token.

View on GitHub (pinned to 2add963021)

Solutions

1. Log the raw token string and confirm every required pair u=, p=, t=, e= is present before it reaches AuthToken.parse
2. Discard the malformed cookie and force re-authentication through the AuthenticationFilter to mint a fresh token
3. If producer and consumer run different Hadoop versions, align them or configure matching AuthenticationToken semantics so the 't' attribute is always written
4. Check for cookie-size limits or proxy rewriting that truncates the 'hadoop.auth' cookie value

Example fix

// before
AuthToken token = AuthToken.parse("u=alice&e=1893456000000");

// after: include all required attributes u, p, t, e
AuthToken token = AuthToken.parse("u=alice&p=alice&t=hadoop&e=1893456000000");

boolean isParseableTokenString(String s) {
  if (s == null) return false;
  String t = s.length() >= 2 && s.charAt(0) == '"' && s.charAt(s.length()-1) == '"'
      ? s.substring(1, s.length()-1) : s;
  java.util.Map<String,String> m = new java.util.HashMap<>();
  for (String part : t.split("&")) {
    int i = part.indexOf('=');
    if (i <= 0) return false;
    m.put(part.substring(0, i), part.substring(i+1));
  }
  m.remove("s");
  return m.keySet().containsAll(java.util.Arrays.asList("u","p","t","e"));
}

try { AuthToken token = AuthToken.parse(str); } catch (AuthenticationException e) { /* log str, clear cookie, force re-authentication */ }

When it happens

Trigger: Calling AuthToken.parse(tokenStr) / AuthenticationToken.parse() on a string such as 'u=alice&e=1234' that is missing the principal ('p') or type ('t') pair; a cookie truncated in transit so the last attribute pairs are cut off; a token string assembled by hand or by an incompatible older hadoop-auth version that did not write the 't' (type) attribute.

Common situations: Reverse proxies or browsers truncating an oversized 'hadoop.auth' cookie; custom clients constructing token strings manually instead of using AuthenticationFilter login; version skew between token producer and verifier after the typed-token change (HADOOP-14697) added the 't' attribute; tests that strip or edit token fields.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Unauthorized access
• Invalid authentication token
• tokenStr cannot be null
• url cannot be NULL
• url must be for a HTTP or HTTPS resource

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/b4e02647eb426a56. Report an issue: GitHub.