apache/hadoop · error · IOException

Missing value for configuration option {}

Error message

Missing value for configuration option {}

What it means

RegistrySecurity.getOrFail(key, defval) reads a configuration option with a default and throws IOException('Missing value for configuration option <key>') when the effective value is null or empty. It guards the JAAS context (hadoop.registry.jaas.context, default 'Client') in SASL mode and the digest credentials (hadoop.registry.client.auth.id / .password, default '') in digest mode — the message always names the exact missing key.

Source

Thrown at hadoop-common-project/hadoop-registry/src/main/java/org/apache/hadoop/registry/client/impl/zk/RegistrySecurity.java:432

    if (usesRealm) {
      userName = ugi.getUserName();
    } else {
      userName = ugi.getShortUserName();
    }
    return new ACL(perms, new Id(SCHEME_SASL, userName));
  }

  /**
   * Get a conf option, throw an exception if it is null/empty
   * @param key key
   * @param defval default value
   * @return the value
   * @throws IOException if missing
   */
  private String getOrFail(String key, String defval) throws IOException {
    String val = getConfig().get(key, defval);
    if (StringUtils.isEmpty(val)) {
      throw new IOException("Missing value for configuration option " + key);
    }
    return val;
  }

  /**
   * Check for an id:password tuple being valid.
   * This test is stricter than that in {@link DigestAuthenticationProvider},
   * which splits the string, but doesn't check the contents of each
   * half for being non-"".
   * @param idPasswordPair id:pass pair
   * @return true if the pass is considered valid.
   */
  public boolean isValid(String idPasswordPair) {
    String[] parts = idPasswordPair.split(":");
    return parts.length == 2
           && !StringUtils.isEmpty(parts[0])
           && !StringUtils.isEmpty(parts[1]);
  }

View on GitHub (pinned to 2add963021)

Solutions

1. Set the option named in the message to a non-empty value — for digest both hadoop.registry.client.auth.id and hadoop.registry.client.auth.password.
2. Or use RegistryOperationsFactory.createAuthenticatedInstance(conf, id, password) / createKerberosInstance, which populate these keys correctly.
3. Audit configuration for empty-string overrides and whitespace-only values of the named key.

Example fix

// before
conf.set("hadoop.registry.client.auth", "digest");
// id/password never set -> IOException: Missing value for configuration option hadoop.registry.client.auth.id

// after
conf.set("hadoop.registry.client.auth.id", "registry");
conf.set("hadoop.registry.client.auth.password", "secret");
// or: RegistryOperationsFactory.createAuthenticatedInstance(conf, "registry", "secret", null);

for (String key : new String[] {
    "hadoop.registry.client.auth.id", "hadoop.registry.client.auth.password"}) {
  if (StringUtils.isEmpty(conf.get(key, ""))) {
    throw new IllegalArgumentException("Missing value for configuration option " + key);
  }
}
RegistryOperations ops = RegistryOperationsFactory.createAuthenticatedInstance(conf, id, pass, null);

try {
  RegistryOperations ops = RegistryOperationsFactory.createAuthenticatedInstance(conf, id, pass, null);
} catch (IOException e) {
  if (e.getMessage().startsWith("Missing value for configuration option")) {
    // message names the exact key: set it (e.g. auth.id / auth.password / jaas.context) and retry
  }
}

When it happens

Trigger: client.auth=digest without hadoop.registry.client.auth.id or hadoop.registry.client.auth.password set (their empty-string defaults trigger the throw); hadoop.registry.jaas.context explicitly set to an empty string; whitespace-only property values.

Common situations: Setting client.auth by hand instead of using RegistryOperationsFactory; partial secure configurations copied between clusters; an empty override of the property in some *-site.xml shadowing a real value.

Related errors

• Unknown/unsupported authentication mechanism; "{}"
• Kerberos required for secure registry access
• No user for ACLs determinable from current user or registry
• ACL '{}' not of expected form scheme:id
• Parsing {} :{}

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/329f64e4cc0ad1fb. Report an issue: GitHub.