apache/hadoop · critical · AccessControlException

${method} authentication is not enabled. Available:${enable

Error message

${method} authentication is not enabled.  Available:${enabledAuthMethods}

What it means

After the server advertised its enabled auth methods, the client INITIATEd with one not on that list (and the server had already sent NEGOTIATE), so processSaslMessage rejects it with AccessControlException listing the enabled methods. The classic case is a client attempting KERBEROS or TOKEN against a server running SIMPLE-only authentication.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/ipc/Server.java:2422

                "Client already attempted negotiation");
          }
          saslResponse = buildSaslNegotiateResponse();
          // simple-only server negotiate response is success which client
          // interprets as switch to simple
          if (saslResponse.getState() == SaslState.SUCCESS) {
            switchToSimple();
          }
          break;
        }
        case INITIATE: {
          if (saslMessage.getAuthsCount() != 1) {
            throw new SaslException("Client mechanism is malformed");
          }
          // verify the client requested an advertised authType
          SaslAuth clientSaslAuth = saslMessage.getAuths(0);
          if (!negotiateResponse.getAuthsList().contains(clientSaslAuth)) {
            if (sentNegotiate) {
              throw new AccessControlException(
                  clientSaslAuth.getMethod() + " authentication is not enabled."
                      + "  Available:" + enabledAuthMethods);
            }
            saslResponse = buildSaslNegotiateResponse();
            break;
          }
          authMethod = AuthMethod.valueOf(clientSaslAuth.getMethod());
          // abort SASL for SIMPLE auth, server has already ensured that
          // SIMPLE is a legit option above.  we will send no response
          if (authMethod == AuthMethod.SIMPLE) {
            switchToSimple();
            saslResponse = null;
            break;
          }
          // sasl server for tokens may already be instantiated
          if (saslServer == null || authMethod != AuthMethod.TOKEN) {
            saslServer = createSaslServer(authMethod);
          }

View on GitHub (pinned to 2add963021)

Solutions

1. Set hadoop.security.authentication to the same value (simple or kerberos) in the client's core-site.xml and the server's.
2. Pick an auth method from the 'Available:' list in the message and configure the client to use it.
3. For secure clusters, make sure the client loads the cluster's actual configuration files and performs kinit.

Example fix

<!-- before: client attempts kerberos, server is simple -->
<property><name>hadoop.security.authentication</name><value>kerberos</value></property>
<!-- after: match the server -->
<property><name>hadoop.security.authentication</name><value>simple</value></property>

String clientAuth = conf.get("hadoop.security.authentication", "simple");
String clusterAuth = clusterConf.get("hadoop.security.authentication", "simple");
if (!clientAuth.equals(clusterAuth)) {
  throw new IllegalStateException("auth mismatch: client=" + clientAuth
      + ", cluster=" + clusterAuth);
}

When it happens

Trigger: Client with hadoop.security.authentication=kerberos talking to a server with simple; client selecting TOKEN when the server has no token secret manager / token auth disabled; any client picking a method absent from the server's 'Available:' list.

Common situations: Client core-site.xml not matching the cluster's security configuration; cross-cluster access (distcp, federation) between secure and insecure clusters; gateway machines with stale configs; clients defaulting to a stronger method than the server permits.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Server asks us to fall back to SIMPLE auth, but this client
• Can't retrieve username from tokenIdentifier.
• FATAL_INVALID_RPC_HEADER
• Client already attempted negotiation
• Client mechanism is malformed

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/546c264375e40325. Report an issue: GitHub.