apache/hadoop · error · AuthorizationException

Protocol {} is not known.

Error message

Protocol {} is not known.

What it means

ServiceAuthorizationManager.authorize throws AuthorizationException when the protocol has no entry in protocolToAcls/protocolToMachineLists — meaning no ACL (and host ACL) was registered for that protocol when the policy was loaded from hadoop-policy.xml via the PolicyProvider. With hadoop.security.authorization=true every protocol needs a security.<protocol>.acl entry.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/authorize/ServiceAuthorizationManager.java:96

  
  /**
   * Authorize the user to access the protocol being used.
   * 
   * @param user user accessing the service 
   * @param protocol service being accessed
   * @param conf configuration to use
   * @param addr InetAddress of the client
   * @throws AuthorizationException on authorization failure
   */
  public void authorize(UserGroupInformation user, 
                               Class<?> protocol,
                               Configuration conf,
                               InetAddress addr
                               ) throws AuthorizationException {
    AccessControlList[] acls = protocolToAcls.get(protocol);
    MachineList[] hosts = protocolToMachineLists.get(protocol);
    if (acls == null || hosts == null) {
      throw new AuthorizationException("Protocol " + protocol + 
                                       " is not known.");
    }

    String clientPrincipal = null;
    if (UserGroupInformation.isSecurityEnabled()) {
      // get client principal key to verify (if available)
      clientPrincipal = SecurityUtil.getClientPrincipal(protocol, conf);
      try {
        if (clientPrincipal != null) {
          clientPrincipal =
              SecurityUtil.getServerPrincipal(clientPrincipal, addr);
        }
      } catch (IOException e) {
        throw (AuthorizationException) new AuthorizationException(
            "Can't figure out Kerberos principal name for connection from "
                + addr + " for user=" + user + " protocol=" + protocol)
            .initCause(e);
      }

View on GitHub (pinned to 2add963021)

Solutions

1. Add security.<protocol-key>.acl (and security.<protocol-key>.hosts if needed) to hadoop-policy.xml, e.g. security.client.protocol.acl=*
2. Confirm hadoop.policy.file points to your policy file (System property, default hadoop-policy.xml) and it is on the classpath
3. For custom protocols, extend the PolicyProvider so refresh() registers ACLs for them
4. Refresh the running services with `dfsadmin -refreshServiceAcl` / `rmadmin -refreshServiceAcl`, or restart them

Example fix

<!-- hadoop-policy.xml: before -->
<!-- no entry for the protocol -> 'Protocol X is not known' -->

<!-- after -->
<property>
  <name>security.client.protocol.acl</name>
  <value>*</value>
</property>

boolean serviceAuthzEnabled = conf.getBoolean(
    CommonConfigurationKeysPublic.HADOOP_SECURITY_AUTHORIZATION, false);
if (serviceAuthzEnabled && customProtocol != null) {
  // ensure hadoop-policy.xml has security.<protocol>.acl before enabling
  Preconditions.checkState(policyCovers(customProtocol),
      "No service ACL for " + customProtocol.getName());
}

try {
  ServiceAuthorizationManager.authorize(user, protocol, conf, addr);
} catch (AuthorizationException e) {
  if (e.getMessage().contains("is not known")) {
    // policy registration problem: fix hadoop-policy.xml / PolicyProvider, not an access issue
  }
  throw e;
}

When it happens

Trigger: Hadoop RPC with service-level authorization enabled where the protocol (e.g. a custom protocol, or org.apache.hadoop.hdfs.protocol.ClientProtocol) has no security.<name>.acl in hadoop-policy.xml; a custom PolicyProvider that does not cover the protocol; calling authorize() for a protocol after a refresh that dropped its entry.

Common situations: Turning on hadoop.security.authorization without completing hadoop-policy.xml; upgrading Hadoop and hitting a newly introduced protocol; third-party services registering custom RPC protocols without policy entries.

Related errors

• User {} is not authorized for protocol {}: {}
• Host {} is not authorized for protocol {}
• hadoop.security.authorizationis configured to true but servi
• Null protocol not authorized
• User: {} is not allowed to impersonate {}

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/88779002fe1a182f. Report an issue: GitHub.