apache/hadoop · error · IllegalArgumentException

{} parameter is not null.

Error message

{} parameter is not null.

What it means

Guard inside the GET op=GETDELEGATIONTOKEN handler. Acquiring a delegation token must run under a real authentication identity (Kerberos/SPNEGO, or user.name in simple mode). If the request also carries the delegation query parameter — i.e. it tries to authenticate with an existing token — the handler throws IllegalArgumentException('<delegation> parameter is not null.') and the client sees HTTP 400. You cannot mint a delegation token while presenting one.

Source

Thrown at hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/web/resources/NamenodeWebHdfsMethods.java:1448

      return Response.ok(js).type(MediaType.APPLICATION_JSON).build();
    }
    case GETFILECHECKSUM:
    {
      final NameNode namenode = (NameNode)context.getAttribute("name.node");
      final URI uri = redirectURI(null, namenode, ugi, delegation, username,
          doAsUser, fullpath, op.getValue(), -1L, -1L, null);
      if(!noredirectParam.getValue()) {
        return Response.temporaryRedirect(uri)
          .type(MediaType.APPLICATION_OCTET_STREAM).build();
      } else {
        final String js = JsonUtil.toJsonString("Location", uri);
        return Response.ok(js).type(MediaType.APPLICATION_JSON).build();
      }
    }
    case GETDELEGATIONTOKEN:
    {
      if (delegation.getValue() != null) {
        throw new IllegalArgumentException(delegation.getName()
            + " parameter is not null.");
      }
      final Token<? extends TokenIdentifier> token = generateDelegationToken(
          ugi, renewer.getValue());

      final String setServiceName = tokenService.getValue();
      final String setKind = tokenKind.getValue();
      if (setServiceName != null) {
        token.setService(new Text(setServiceName));
      }
      if (setKind != null) {
        token.setKind(new Text(setKind));
      }
      final String js = JsonUtil.toJsonString(token);
      return Response.ok(js).type(MediaType.APPLICATION_JSON).build();
    }
    case GETHOMEDIRECTORY: {
      String userHome = DFSUtilClient.getHomeDirectory(conf, ugi);

View on GitHub (pinned to 2add963021)

Solutions

1. Remove the delegation parameter from the GETDELEGATIONTOKEN request URL
2. Authenticate for this one call with Kerberos (SPNEGO) or &user.name=<user> instead
3. If a valid token already exists, reuse it rather than requesting another
4. Audit client code that blindly forwards stored parameters onto each request

Example fix

# before
curl "http://nn:9870/webhdfs/v1/?op=GETDELEGATIONTOKEN&renewer=oozie&delegation=EAo..."
# 400 ... IllegalArgumentException: delegation parameter is not null.

# after
curl --negotiate -u : "http://nn:9870/webhdfs/v1/?op=GETDELEGATIONTOKEN&renewer=oozie"

static String getDelegationTokenUrl(String renewer) {
  // acquisition must use real auth: never attach the delegation parameter here
  return "/webhdfs/v1/?op=GETDELEGATIONTOKEN&renewer="
      + URLEncoder.encode(renewer, StandardCharsets.UTF_8);
}

catch (IOException e) { // 400 ... delegation parameter is not null.
  if (e.getMessage() != null && e.getMessage().contains("delegation parameter is not null")) {
    // strip stored token from URL and re-authenticate with kerberos/user.name
  } else throw e;
}

When it happens

Trigger: GET /webhdfs/v1/?op=GETDELEGATIONTOKEN&renewer=<user>&delegation=<existingToken>. Typical of clients that merge all previously seen query parameters onto every subsequent request, or token-refresh workflows that reuse an authenticated URL as a template.

Common situations: Generic REST wrappers that keep one parameter map per session; copy-pasting a URL from the audit log (it contains the delegation token used earlier); downstream services fetching their own token while a shared token is already in the request context.

Related errors

• Failed to obtain user group information: {}
• The client is configured to only allow connecting to secure
• Delegation Token can be issued only with kerberos or web aut
• Delegation Token can be renewed only with kerberos or web au
• Can't retrieve username from tokenIdentifier.

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/b46b7b0753f34b15. Report an issue: GitHub.