apache/hadoop · critical · RuntimeException

No secret in signature secret file: ${signatureSecretFile}

Error message

No secret in signature secret file: ${signatureSecretFile}

What it means

FileSignerSecretProvider reads the whole content of the file configured via signature.secret.file and uses it verbatim as the HMAC secret for signing authentication cookies. If the file exists but is empty (zero bytes), provider initialization fails with this RuntimeException, which aborts servlet/filter startup.

Source

Thrown at hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/util/FileSignerSecretProvider.java:58

  public void init(Properties config, ServletContext servletContext,
                   long tokenValidity) throws Exception {

    String signatureSecretFile = config.getProperty(
        AuthenticationFilter.SIGNATURE_SECRET_FILE, null);

    if (signatureSecretFile != null) {
      try (Reader reader = new InputStreamReader(Files.newInputStream(
              Paths.get(signatureSecretFile)), StandardCharsets.UTF_8)) {
        StringBuilder sb = new StringBuilder();
        int c = reader.read();
        while (c > -1) {
          sb.append((char) c);
          c = reader.read();
        }

        secret = sb.toString().getBytes(StandardCharsets.UTF_8);
        if (secret.length == 0) {
          throw new RuntimeException("No secret in signature secret file: "
             + signatureSecretFile);
        }
      } catch (IOException ex) {
        throw new RuntimeException("Could not read signature secret file: " +
            signatureSecretFile);
      }
    }

    secrets = new byte[][]{secret};
  }

  @Override
  public byte[] getCurrentSecret() {
    return secret;
  }

  @Override
  public byte[][] getAllSecrets() {

View on GitHub (pinned to 2add963021)

Solutions

Write a non-empty random secret into the file, e.g. 'head -c 64 /dev/urandom | base64 > /etc/hadoop/auth-secret', and restart the service
Confirm the path in signature.secret.file is the file you actually edited
Add a deployment check that fails when the secret file is empty

Example fix

# before
touch /etc/hadoop/auth-secret   # empty file -> RuntimeException

# after
head -c 64 /dev/urandom | base64 > /etc/hadoop/auth-secret
chown hadoop:hadoop /etc/hadoop/auth-secret && chmod 600 /etc/hadoop/auth-secret

Defensive patterns

Strategy: validation

Validate before calling

// pre-start check
java.nio.file.Path p = java.nio.file.Paths.get(secretFile);
if (!java.nio.file.Files.exists(p) || java.nio.file.Files.size(p) == 0) {
  throw new IllegalStateException("signature.secret.file missing or empty: " + secretFile);
}

Try / catch

try { provider.init(props, context, tokenValidity); } catch (RuntimeException e) { /* config/init error — fix deployment, do not retry */ }

Prevention

Generate secrets with 'head -c 64 /dev/urandom | base64' and verify non-empty before deploy
Alert on zero-length secret files in config management
Document which node/role owns writing the secret file

When it happens

Trigger: Initializing FileSignerSecretProvider (via the AuthenticationFilter 'signer.secret.provider' = 'file' configuration) where signature.secret.file points to a zero-length file.

Common situations: A placeholder secret file created empty by an automation playbook awaiting manual fill; a file truncated during deployment; someone editing the secret to empty while rotating keys.

Related errors

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/0f373bc34ffa5de7. Report an issue: GitHub.