apache/hadoop · warning · NoSuchFieldException

oidName: ${oidName} is not supported.

Error message

oidName: ${oidName} is not supported.

What it means

This deprecated helper maps a small fixed set of constant names to JGSS Oid objects for SPNEGO/Kerberos. Only 'GSS_SPNEGO_MECH_OID', 'GSS_KRB5_MECH_OID' and 'NT_GSS_KRB5_PRINCIPAL' are recognized; anything else throws NoSuchFieldException('oidName: ... is not supported.') for compatibility with the old reflection-based lookup.

Source

Thrown at hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/util/KerberosUtil.java:99

   * @throws ClassNotFoundException for backward compatibility.
   * @throws GSSException for backward compatibility.
   * @throws NoSuchFieldException if the input is not supported.
   * @throws IllegalAccessException for backward compatibility.
   *
   */
  @Deprecated
  public static Oid getOidInstance(String oidName)
      throws ClassNotFoundException, GSSException, NoSuchFieldException,
      IllegalAccessException {
    switch (oidName) {
    case "GSS_SPNEGO_MECH_OID":
      return GSS_SPNEGO_MECH_OID;
    case "GSS_KRB5_MECH_OID":
      return GSS_KRB5_MECH_OID;
    case "NT_GSS_KRB5_PRINCIPAL":
      return NT_GSS_KRB5_PRINCIPAL_OID;
    default:
      throw new NoSuchFieldException(
          "oidName: " + oidName + " is not supported.");
    }
  }

  /**
   * Return the default realm for this JVM.
   *
   * @return The default realm
   * @throws IllegalArgumentException If the default realm does not exist.
   * @throws ClassNotFoundException Not thrown. Exists for compatibility.
   * @throws NoSuchMethodException Not thrown. Exists for compatibility.
   * @throws IllegalAccessException Not thrown. Exists for compatibility.
   * @throws InvocationTargetException Not thrown. Exists for compatibility.
   */
  public static String getDefaultRealm()
      throws ClassNotFoundException, NoSuchMethodException,
      IllegalArgumentException, IllegalAccessException,
      InvocationTargetException {

View on GitHub (pinned to 2add963021)

Solutions

1. Pass one of the three supported names verbatim
2. Better: stop using the deprecated method and construct Oids directly, e.g. new Oid("1.3.6.1.5.5.2") for SPNEGO
3. For the common cases, use the constants already exposed by KerberosUtil or GSSUtil

Example fix

// before
Oid oid = KerberosUtil.getOidInstance("GSS_NT_EXPORT_CONTEXT"); // NoSuchFieldException

// after
Oid spnego = new Oid("1.3.6.1.5.5.2");
Oid krb5 = new Oid("1.2.840.113554.1.2.2");

java.util.Set<String> SUPPORTED = java.util.Set.of(
    "GSS_SPNEGO_MECH_OID", "GSS_KRB5_MECH_OID", "NT_GSS_KRB5_PRINCIPAL");
if (!SUPPORTED.contains(oidName)) throw new IllegalArgumentException(oidName);

// prefer direct Oid construction over the deprecated lookup
static Optional<Oid> toOid(String name) {
  switch (name) {
    case "GSS_SPNEGO_MECH_OID": return Optional.of(newOid("1.3.6.1.5.5.2"));
    case "GSS_KRB5_MECH_OID":   return Optional.of(newOid("1.2.840.113554.1.2.2"));
    case "NT_GSS_KRB5_PRINCIPAL": return Optional.of(newOid("1.2.840.113554.1.2.2.1"));
    default: return Optional.empty();
  }
}

try { Oid o = KerberosUtil.getOidInstance(name); } catch (NoSuchFieldException e) { /* unknown constant: switch to direct new Oid(...) */ }

When it happens

Trigger: Calling KerberosUtil.getOidInstance() with a name like 'GSS_NT_S...' or a made-up constant; migrating code that used Class.getField(name).get(null) on GSSUtil and passing an arbitrary field name.

Common situations: Code written against an old hadoop-auth that reflected on org.ietf.jgss.GSSUtil fields; callers assuming any JGSS constant name is accepted.

Related errors

• Invalid SPNEGO sequence, 'WWW-Authenticate' header incorrect
• Invalid SPNEGO sequence, status code: {}
• Malformed Kerberos name: ${name}
• Malformed gss token
• Not an AP-REQ token

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/78d64e27dacf5763. Report an issue: GitHub.