apache/hadoop · error · IOException

MR AM not authorized to cancel delegation token

Error message

MR AM not authorized to cancel delegation token

What it means

MRClientService.cancelDelegationToken unconditionally throws for the same reason as get/renew: the AM never mints delegation tokens, so cancellation against the AM is a category error. Cancelling a valid JHS-issued token must be sent to the JobHistoryServer that issued it.

Source

Thrown at hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-app/src/main/java/org/apache/hadoop/mapreduce/v2/app/client/MRClientService.java:438

    @Override
    public GetDelegationTokenResponse getDelegationToken(
        GetDelegationTokenRequest request) throws IOException {
      throw new IOException("MR AM not authorized to issue delegation" +
      		" token");
    }

    @Override
    public RenewDelegationTokenResponse renewDelegationToken(
        RenewDelegationTokenRequest request) throws IOException {
      throw new IOException("MR AM not authorized to renew delegation" +
          " token");
    }

    @Override
    public CancelDelegationTokenResponse cancelDelegationToken(
        CancelDelegationTokenRequest request) throws IOException {
      throw new IOException("MR AM not authorized to cancel delegation" +
          " token");
    }
  }

  public KillTaskAttemptResponse forceKillTaskAttempt(
      KillTaskAttemptRequest request) throws YarnException, IOException {
    return protocolHandler.killTaskAttempt(request);
  }

  public WebApp getWebApp() {
    return webApp;
  }

  protected ResourceConfig configure() {
    ResourceConfig config = new ResourceConfig();
    config.register(new JerseyBinder());
    config.register(AMWebServices.class);
    config.register(GenericExceptionHandler.class);

View on GitHub (pinned to 2add963021)

Solutions

1. Route cancellation to the issuing JobHistoryServer (HSClientProtocol), matching token.getService()
2. If the operation came from generic token-cleanup code, gate it on token.getKind()/service instead of the protocol type
3. Treat this IOException from the AM as non-fatal — the token was never valid against the AM anyway

try {
  token.cancel(conf);
} catch (IOException e) {
  if (e.getMessage().contains("not authorized to cancel delegation token")) {
    // token was never valid against the AM; cancel at issuing JHS if needed
  } else { throw e; }
}

When it happens

Trigger: Client calls protocol.cancelDelegationToken(CancelDelegationTokenRequest) on the AM tracking address; cleanup code iterates credentials and cancels each token via whichever MR protocol handle is open.

Common situations: Session cleanup code shared between JHS and AM handles; test harnesses pointing every MR operation at the first protocol stub they created.

Related errors

• MR AM not authorized to issue delegation token
• MR AM not authorized to renew delegation token
• Can't get Master Kerberos principal for use as renewer
• Can't retrieve username from tokenIdentifier.
• FATAL_UNAUTHORIZED

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/41b1151c6babee80. Report an issue: GitHub.