apache/hadoop · error · IOException

Security enabled but user not authenticated by filter

Error message

Security enabled but user not authenticated by filter

What it means

In JspHelper.getUGI, when UserGroupInformation.isSecurityEnabled() is true the code requires either a delegation token parameter (DELEGATION_PARAMETER_NAME) or a non-null request.getRemoteUser(). If neither is present it throws IOException('Security enabled but user not authenticated by filter') — remoteUser is only populated when the hadoop-auth (SPNEGO/Kerberos) authentication filter ran successfully in front of the servlet. The exception therefore means the request reached the JSP layer anonymous.

Source

Thrown at hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/common/JspHelper.java:125

   */
  public static UserGroupInformation getUGI(ServletContext context,
      HttpServletRequest request, Configuration conf,
      final AuthenticationMethod secureAuthMethod,
      final boolean tryUgiParameter) throws IOException {
    UserGroupInformation ugi = null;
    final String usernameFromQuery = getUsernameFromQuery(request, tryUgiParameter);
    final String doAsUserFromQuery = request.getParameter(DoAsParam.NAME);
    final String remoteUser;
   
    if (UserGroupInformation.isSecurityEnabled()) {
      remoteUser = request.getRemoteUser();
      final String tokenString = request.getParameter(DELEGATION_PARAMETER_NAME);
      if (tokenString != null) {

        // user.name, doas param is ignored in the token-based auth
        ugi = getTokenUGI(context, request, tokenString, conf);
      } else if (remoteUser == null) {
        throw new IOException(
            "Security enabled but user not authenticated by filter");
      }
    } else {
      // Security's not on, pull from url or use default web user
      remoteUser = (usernameFromQuery == null)
          ? getDefaultWebUserName(conf) // not specified in request
          : usernameFromQuery;
    }

    if (ugi == null) { // security is off, or there's no token
      ugi = UserGroupInformation.createRemoteUser(remoteUser);
      if (UserGroupInformation.isSecurityEnabled()) {
        // This is not necessarily true, could have been auth'ed by user-facing
        // filter
        ugi.setAuthenticationMethod(secureAuthMethod);
      }
      if (doAsUserFromQuery != null && !doAsUserFromQuery.equals(remoteUser)) {
        // create and attempt to authorize a proxy user

View on GitHub (pinned to 2add963021)

Solutions

1. Authenticate: kinit then use 'curl --negotiate -u :' or a SPNEGO-configured browser
2. Or pass a delegation token via the delegation parameter, obtained through WebHDFS GETDELEGATIONTOKEN
3. Verify hadoop.http.authentication.type=kerberos and that hadoop.http.authentication.kerberos.principal/keytab are correct so the filter actually challenges anonymous requests
4. Confirm the requested URL is served through the filter-protected endpoint (not a port or path that bypasses the authentication filter chain)

Example fix

# before (anonymous, throws)
curl http://nn:9870/browseBlock.jsp?... 

# after (SPNEGO)
kinit alice@EXAMPLE.COM && curl --negotiate -u : 'http://nn:9870/browseBlock.jsp?...'

if (UserGroupInformation.isSecurityEnabled()
    && request.getParameter(DelegationParam.NAME) == null
    && request.getRemoteUser() == null) {
  resp.setHeader("WWW-Authenticate", "Negotiate");
  resp.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Authenticate");
  return; // never reach JspHelper.getUGI anonymous
}

try {
  ugi = JspHelper.getUGI(context, request, conf);
} catch (IOException e) {
  if ("Security enabled but user not authenticated by filter".equals(e.getMessage())) {
    resp.setHeader("WWW-Authenticate", "Negotiate");
    resp.sendError(401, "Kerberos authentication required");
  } else throw e;
}

When it happens

Trigger: Kerberized cluster, request to a NameNode/DataNode web UI JSP that carries no delegation token and no Negotiate authentication, so request.getRemoteUser() is null: direct curl/browser access without SPNEGO, a filter chain that does not cover the hit path, or SPNEGO misconfiguration where the auth filter fails and passes the request through unauthenticated.

Common situations: curl or a browser without SPNEGO hitting secured JSPs; hadoop.http.authentication.* principal/keytab/type misconfigured so the filter never authenticates; custom or moved servlet paths added outside the authentication filter's URL mappings; health-check scripts that assume anonymous access like in non-secured clusters.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Failed to obtain user group information: {}
• Delegation Token can be issued only with kerberos or web aut
• Delegation Token can be renewed only with kerberos or web au
• Invalid SPNEGO sequence, 'WWW-Authenticate' header incorrect
• Invalid SPNEGO sequence, status code: {}

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/0feddcd6898ac862. Report an issue: GitHub.