apache/hadoop · error · AccessControlException

{renewer} tries to renew a token {formatTokenId(id)} with no

Error message

{renewer} tries to renew a token {formatTokenId(id)} with non-matching renewer {id.getRenewer()}

What it means

Error "{renewer} tries to renew a token {formatTokenId(id)} with non-matching renewer {id.getRenewer()}" thrown in apache/hadoop.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/AbstractDelegationTokenSecretManager.java:699

      ByteArrayInputStream buf = new ByteArrayInputStream(token.getIdentifier());
      DataInputStream in = new DataInputStream(buf);
      TokenIdent id = createIdentifier();
      id.readFields(in);
      LOG.info("Token renewal for identifier: " + formatTokenId(id) + "; total currentTokens "
          + currentTokens.size());

      long now = Time.now();
      if (id.getMaxDate() < now) {
        throw new InvalidToken(renewer + " tried to renew an expired token " + formatTokenId(id) +
            " max expiration date: " + Time.formatTime(id.getMaxDate()) + " currentTime: " +
            Time.formatTime(now));
      }
      if ((id.getRenewer() == null) || (id.getRenewer().toString().isEmpty())) {
        throw new AccessControlException(renewer + " tried to renew a token " + formatTokenId(id) +
            " without a renewer");
      }
      if (!id.getRenewer().toString().equals(renewer)) {
        throw new AccessControlException(renewer + " tries to renew a token " + formatTokenId(id) +
            " with non-matching renewer " + id.getRenewer());
      }
      DelegationKey key = getDelegationKey(id.getMasterKeyId());
      if (key == null) {
        throw new InvalidToken("Unable to find master key for keyId=" + id.getMasterKeyId() +
            " from cache. Failed to renew an unexpired token " + formatTokenId(id) +
            " with sequenceNumber=" + id.getSequenceNumber());
      }
      byte[] password = createPassword(token.getIdentifier(), key.getKey());
      if (!MessageDigest.isEqual(password, token.getPassword())) {
        throw new AccessControlException(
            renewer + " is trying to renew a token " + formatTokenId(id) + " with wrong password");
      }
      long renewTime = Math.min(id.getMaxDate(), now + tokenRenewInterval);
      String trackingId = getTrackingIdIfEnabled(id);
      DelegationTokenInformation info =
          new DelegationTokenInformation(renewTime, password, trackingId);

View on GitHub (pinned to 2add963021)

Solutions

1. Only the renewer recorded in the token ({id.getRenewer()}) may renew it. Renew using that principal's credentials, or re-issue the token with '{renewer}' as the renewer.

When it happens

Trigger: Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/AbstractDelegationTokenSecretManager.java:699 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/6fd59c88f2f73a73. Report an issue: GitHub.