What causes "MR AM not authorized to renew delegation token" in apache/hadoop?

Renew only against the issuing service — tokens from the JHS carry the JHS address; print token.getService() to confirm where renewal must go

apache/hadoop · error · IOException

MR AM not authorized to renew delegation token

Error message

MR AM not authorized to renew delegation token

What it means

MRClientService.renewDelegationToken unconditionally throws: the MR ApplicationMaster is not a token issuer, so it has nothing to renew. Renewal is only meaningful against the service that created the token (JobHistoryServer / RM as appropriate). Because the AM's MRClientProtocol shares the wire protocol with the JHS, generic renewal code can reach this method by mistake.

Source

Thrown at hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-app/src/main/java/org/apache/hadoop/mapreduce/v2/app/client/MRClientService.java:431

        for (Task task : tasks) {
          response.addTaskReport(task.getReport());
        }
      }

      return response;
    }

    @Override
    public GetDelegationTokenResponse getDelegationToken(
        GetDelegationTokenRequest request) throws IOException {
      throw new IOException("MR AM not authorized to issue delegation" +
      		" token");
    }

    @Override
    public RenewDelegationTokenResponse renewDelegationToken(
        RenewDelegationTokenRequest request) throws IOException {
      throw new IOException("MR AM not authorized to renew delegation" +
          " token");
    }

    @Override
    public CancelDelegationTokenResponse cancelDelegationToken(
        CancelDelegationTokenRequest request) throws IOException {
      throw new IOException("MR AM not authorized to cancel delegation" +
          " token");
    }
  }

  public KillTaskAttemptResponse forceKillTaskAttempt(
      KillTaskAttemptRequest request) throws YarnException, IOException {
    return protocolHandler.killTaskAttempt(request);
  }

  public WebApp getWebApp() {
    return webApp;

View on GitHub (pinned to 2add963021)

Solutions

Renew only against the issuing service — tokens from the JHS carry the JHS address; print token.getService() to confirm where renewal must go
Verify mapreduce.jobhistory.address / mapreduce.jobhistory.webapp.address resolve to the real JobHistoryServer
Catch this IOException in renewal loops and skip AM-issued endpoints instead of failing the whole renewal pass

Defensive patterns

Strategy: fallback

Try / catch

try {
  token.renew(conf);
} catch (IOException e) {
  if (e.getMessage().contains("not authorized to renew delegation token")) {
    skipEndpoint(); // AM is not the issuer; renew via the issuing JHS instead
  } else { throw e; }
}

Prevention

Renew each token against its issuing service (token.getService()), never against an arbitrary MR endpoint
Keep mapreduce.jobhistory.address correct so renewal threads resolve the JHS
Exclude AM-protocol stubs from generic renewal loops

When it happens

Trigger: Client-side Token.renew() invoked with the AM's service principal/address (the token's service field resolves to the AM); a delegation-renewal thread walking all MR endpoints renews against the AM.

Common situations: Long-running clients that renew every collected token in one loop without checking which service issued it; misconfigured mapreduce.jobhistory.address causing the client to fall back to the AM endpoint.

Related errors

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/2fe722aa97bbcd46. Report an issue: GitHub.