apache/hadoop · error · AccessControlException

{renewer} is trying to renew a token {formatTokenId(id)} wit

Error message

{renewer} is trying to renew a token {formatTokenId(id)} with wrong password

What it means

Error "{renewer} is trying to renew a token {formatTokenId(id)} with wrong password" thrown in apache/hadoop.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/AbstractDelegationTokenSecretManager.java:710

            Time.formatTime(now));
      }
      if ((id.getRenewer() == null) || (id.getRenewer().toString().isEmpty())) {
        throw new AccessControlException(renewer + " tried to renew a token " + formatTokenId(id) +
            " without a renewer");
      }
      if (!id.getRenewer().toString().equals(renewer)) {
        throw new AccessControlException(renewer + " tries to renew a token " + formatTokenId(id) +
            " with non-matching renewer " + id.getRenewer());
      }
      DelegationKey key = getDelegationKey(id.getMasterKeyId());
      if (key == null) {
        throw new InvalidToken("Unable to find master key for keyId=" + id.getMasterKeyId() +
            " from cache. Failed to renew an unexpired token " + formatTokenId(id) +
            " with sequenceNumber=" + id.getSequenceNumber());
      }
      byte[] password = createPassword(token.getIdentifier(), key.getKey());
      if (!MessageDigest.isEqual(password, token.getPassword())) {
        throw new AccessControlException(
            renewer + " is trying to renew a token " + formatTokenId(id) + " with wrong password");
      }
      long renewTime = Math.min(id.getMaxDate(), now + tokenRenewInterval);
      String trackingId = getTrackingIdIfEnabled(id);
      DelegationTokenInformation info =
          new DelegationTokenInformation(renewTime, password, trackingId);

      if (getTokenInfo(id) == null) {
        throw new InvalidToken("Renewal request for unknown token " + formatTokenId(id));
      }
      METRICS.trackUpdateToken(() -> updateToken(id, info));
      return renewTime;
    } finally {
      this.apiLock.writeLock().unlock();
    }
  }
  
  /**

View on GitHub (pinned to 2add963021)

Solutions

1. The token password does not match the secret manager's stored password for {formatTokenId(id)}: the token is stale, forged, or the master key rolled. Obtain a fresh token from the service.

When it happens

Trigger: Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/AbstractDelegationTokenSecretManager.java:710 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/e194644e09155256. Report an issue: GitHub.