apache/hadoop · error · AuthorizationException

Null protocol not authorized

Error message

Null protocol not authorized

What it means

When service-level authorization is enabled (hadoop.security.authorization=true), Server.authorize must map every incoming connection to a protocol class so the hadoop-policy.xml ACLs can be evaluated. A connection whose header declares no protocol (protocolName == null) cannot be matched against any ACL, so it is rejected with AuthorizationException before any call executes. This is a server-side refusal, not a client-side validation error.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/ipc/Server.java:3909

   * @return Call.
   * @throws Exception raised on errors performing I/O.
   */
  public abstract Writable call(RPC.RpcKind rpcKind, String protocol,
      Writable param, long receiveTime) throws Exception;
  
  /**
   * Authorize the incoming client connection.
   * 
   * @param user client user
   * @param protocolName - the protocol
   * @param addr InetAddress of incoming connection
   * @throws AuthorizationException when the client isn't authorized to talk the protocol
   */
  private void authorize(UserGroupInformation user, String protocolName,
      InetAddress addr) throws AuthorizationException {
    if (authorize) {
      if (protocolName == null) {
        throw new AuthorizationException("Null protocol not authorized");
      }
      Class<?> protocol = null;
      try {
        protocol = getProtocolClass(protocolName, getConf());
      } catch (ClassNotFoundException cfne) {
        throw new AuthorizationException("Unknown protocol: " + 
                                         protocolName);
      }
      serviceAuthorizationManager.authorize(user, protocol, getConf(), addr);
    }
  }
  
  /**
   * Get the port on which the IPC Server is listening for incoming connections.
   * This could be an ephemeral port too, in which case we return the real
   * port on which the Server has bound.
   * @return port on which IPC Server is listening
   */

View on GitHub (pinned to 2add963021)

Solutions

1. Make the client declare a protocol: build the proxy with RPC.Builder.setProtocol(...) (or RPC.getProxy/WAITFOR with the protocol class) so the connection header carries a non-null protocol name.
2. Upgrade the client to a Hadoop version matching the server so the header layout and protocol declaration match.
3. If the protocol-less connection is intentional (internal liveness check) and cannot be changed, evaluate disabling service authorization (hadoop.security.authorization=false) — accepting the loss of protocol-level ACLs.

Example fix

// before
RPC.ClientBaseProtocolProbe p = new RPC.ClientBaseProtocolProbe(); // protocol-less connection

// after
MyProtocol proxy = RPC.getProxy(MyProtocol.class, versionID, addr, ugi, conf, fallback);
// connection header now carries MyProtocol.class.getName()

// Client side: always pass a concrete protocol class so the header is non-null
if (protocol == null) {
  throw new IllegalArgumentException("protocol class is required when "
      + "hadoop.security.authorization is enabled on the server");
}
T proxy = RPC.getProxy(protocol, version, addr, ugi, conf, null);

try {
  proxy.ping();
} catch (RemoteException re) {
  if (re.getClassName().endsWith("AuthorizationException")) {
    // 'Null protocol not authorized': connection header carried no protocol
    LOG.error("Server rejected protocol-less connection: {}", re.getMessage());
  }
}

When it happens

Trigger: A client opens an IPC connection with a null/absent protocol field in the connection header (protocol-less pings, hand-rolled RPC clients, or an RPC proxy built without setting a protocol class) while the server runs with hadoop.security.authorization=true. Server.authorize(user, null, addr) then throws.

Common situations: Enabling service authorization on a cluster that still runs older or third-party clients sending protocol-less headers; custom admin/health-check tools built directly on RPC.Client; version-skewed clients after a rolling upgrade.

Related errors

• User {} is not authorized for protocol {}: {}
• Host {} is not authorized for protocol {}
• hadoop.security.authorizationis configured to true but servi
• Server asks us to fall back to SIMPLE auth, but this client
• AuthenticationMethod.TOKEN + " authentication requires a sec

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/c481e1a72ec09301. Report an issue: GitHub.