apache/hadoop · error · AuthenticationException

'%s' did not respond with JSON to the '%s' delegation token

Error message

'%s' did not respond with JSON to the '%s' delegation token operation

What it means

Client-side guard in doDelegationTokenOperation: for ops with a response, the Content-Type header must exist and contain application/json. When it does not, the client throws AuthenticationException "'<authority>' did not respond with JSON to the '<op>' delegation token operation" - the endpoint answered, but whatever came back (usually an HTML login/404/error page) is not a delegation-token API response.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/web/DelegationTokenAuthenticator.java:342

    try {
      conn = aUrl.openConnection(url, token);
      conn.setRequestMethod(operation.getHttpMethod());
      HttpExceptionUtils.validateResponse(conn, HttpURLConnection.HTTP_OK);
      if (hasResponse) {
        String contentType = conn.getHeaderField(CONTENT_TYPE);
        contentType =
            (contentType != null) ? StringUtils.toLowerCase(contentType) : null;
        if (contentType != null &&
            contentType.contains(APPLICATION_JSON_MIME)) {
          try {
            ret = JsonSerialization.mapReader().readValue(conn.getInputStream());
          } catch (Exception ex) {
            throw new AuthenticationException(String.format(
                "'%s' did not handle the '%s' delegation token operation: %s",
                url.getAuthority(), operation, ex.getMessage()), ex);
          }
        } else {
          throw new AuthenticationException(String.format("'%s' did not " +
                  "respond with JSON to the '%s' delegation token operation",
              url.getAuthority(), operation));
        }
      }
    } finally {
      if (dt != null) {
        ((DelegationTokenAuthenticatedURL.Token) token).setDelegationToken(dt);
      }
      if (conn != null) {
        conn.disconnect();
      }
    }
    return ret;
  }

}

View on GitHub (pinned to 2add963021)

Solutions

1. curl -i the exact URL and confirm it serves application/json for the op; fix the URL/port to the token-aware web endpoint.
2. Authenticate up front (SPNEGO/token) so gateways do not redirect to HTML login pages.
3. Fix gateway/proxy routing to pass delegation-token operations through to Hadoop untouched.
4. Verify the op name is spelled GETDELEGATIONTOKEN/RENEWDELEGATIONTOKEN so the filter handles it.

Example fix

# before: hitting a non-token endpoint -> Content-Type: text/html
url = new URL("http://nn:9870/")
# after: use the endpoint fronted by DelegationTokenAuthenticationFilter
url = new URL("http://nn:1022/webhdfs/v1/?op=GETDELEGATIONTOKEN&renewer=hdfs")

// Validate the URL targets a token-aware endpoint before calling the API
HttpURLConnection c = (HttpURLConnection) url.openConnection();
String ct = c.getHeaderField("Content-Type");
boolean json = ct != null && ct.toLowerCase().contains("application/json");
if (!json) throw new IOException("Not a delegation-token endpoint: " + url);

catch (AuthenticationException e) {
  if (e.getMessage().contains("did not respond with JSON")) {
    // wrong endpoint or gateway redirect: fix URL/port or authenticate first, then retry
  }
}

When it happens

Trigger: GETDELEGATIONTOKEN/RENEW sent to a URL not fronted by DelegationTokenAuthenticationFilter (plain HTTP server, wrong port, 404 static page), an auth redirect (302 to an HTML login form) from an SSO/gateway, or a text/plain servlet error.

Common situations: Wrong port or path (e.g. NameNode RPC/web port instead of the token-aware web endpoint, HttpFS 14000 vs WebHDFS 1022/9870); Knox/gateway SSO intercepting unauthenticated requests; HTTP->HTTPS redirect losing the op.

Related errors

• '%s' did not handle the '%s' delegation token operation: %s
• This should not happen: ${ex.getMessage()}
• request UGI cannot be NULL
• "Invalid Content-Length header: " + contentLength
• "Content-Length header is not provided by the server when tr

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/7b9de9e71a86b8fd. Report an issue: GitHub.