apache/hadoop · error · AccessControlException

{renewer} tried to renew a token {formatTokenId(id)} without

Error message

{renewer} tried to renew a token {formatTokenId(id)} without a renewer

What it means

Error "{renewer} tried to renew a token {formatTokenId(id)} without a renewer" thrown in apache/hadoop.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/AbstractDelegationTokenSecretManager.java:695

  public long renewToken(Token<TokenIdent> token,
                         String renewer) throws InvalidToken, IOException {
    this.apiLock.writeLock().lock();
    try {
      ByteArrayInputStream buf = new ByteArrayInputStream(token.getIdentifier());
      DataInputStream in = new DataInputStream(buf);
      TokenIdent id = createIdentifier();
      id.readFields(in);
      LOG.info("Token renewal for identifier: " + formatTokenId(id) + "; total currentTokens "
          + currentTokens.size());

      long now = Time.now();
      if (id.getMaxDate() < now) {
        throw new InvalidToken(renewer + " tried to renew an expired token " + formatTokenId(id) +
            " max expiration date: " + Time.formatTime(id.getMaxDate()) + " currentTime: " +
            Time.formatTime(now));
      }
      if ((id.getRenewer() == null) || (id.getRenewer().toString().isEmpty())) {
        throw new AccessControlException(renewer + " tried to renew a token " + formatTokenId(id) +
            " without a renewer");
      }
      if (!id.getRenewer().toString().equals(renewer)) {
        throw new AccessControlException(renewer + " tries to renew a token " + formatTokenId(id) +
            " with non-matching renewer " + id.getRenewer());
      }
      DelegationKey key = getDelegationKey(id.getMasterKeyId());
      if (key == null) {
        throw new InvalidToken("Unable to find master key for keyId=" + id.getMasterKeyId() +
            " from cache. Failed to renew an unexpired token " + formatTokenId(id) +
            " with sequenceNumber=" + id.getSequenceNumber());
      }
      byte[] password = createPassword(token.getIdentifier(), key.getKey());
      if (!MessageDigest.isEqual(password, token.getPassword())) {
        throw new AccessControlException(
            renewer + " is trying to renew a token " + formatTokenId(id) + " with wrong password");
      }
      long renewTime = Math.min(id.getMaxDate(), now + tokenRenewInterval);

View on GitHub (pinned to 2add963021)

Solutions

1. The token {formatTokenId(id)} has no renewer set, so it cannot be renewed. Re-issue the token with a renewer (e.g. the RM/YARN principal) if renewal is needed.

When it happens

Trigger: Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/AbstractDelegationTokenSecretManager.java:695 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/cc3e007738646ced. Report an issue: GitHub.