apache/hadoop · critical · RuntimeException

Security is enabled but block access tokens (via dfs.block.a

Error message

Security is enabled but block access tokens (via dfs.block.access.token.enable) aren't enabled. This may cause issues when clients attempt to connect to a DataNode. Aborting DataNode

What it means

checkSecureConfig runs during DN startup in secure deployments: when Kerberos is active but dfs.block.access.token.enable is false, the DN aborts with this RuntimeException. Block access tokens are how an authenticated client proves to a DataNode it may read or write a block; without them a 'secure' cluster's DNs would accept unauthenticated block traffic, so the DN refuses to run.

Source

Thrown at hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/datanode/DataNode.java:2012

   * @throws RuntimeException if security enabled, but configuration is insecure
   */
  private static void checkSecureConfig(DNConf dnConf, Configuration conf,
      SecureResources resources) throws RuntimeException {
    if (!UserGroupInformation.isSecurityEnabled()) {
      return;
    }

    // Abort out of inconsistent state if Kerberos is enabled
    // but block access tokens are not enabled.
    boolean isEnabled = conf.getBoolean(
        DFSConfigKeys.DFS_BLOCK_ACCESS_TOKEN_ENABLE_KEY,
        DFSConfigKeys.DFS_BLOCK_ACCESS_TOKEN_ENABLE_DEFAULT);
    if (!isEnabled) {
      String errMessage = "Security is enabled but block access tokens " +
          "(via " + DFSConfigKeys.DFS_BLOCK_ACCESS_TOKEN_ENABLE_KEY + ") " +
          "aren't enabled. This may cause issues " +
          "when clients attempt to connect to a DataNode. Aborting DataNode";
      throw new RuntimeException(errMessage);
    }

    if (dnConf.getIgnoreSecurePortsForTesting()) {
      return;
    }

    if (resources != null) {
      final boolean httpSecured = resources.isHttpPortPrivileged()
          || DFSUtil.getHttpPolicy(conf) == HttpConfig.Policy.HTTPS_ONLY;
      final boolean rpcSecured = resources.isRpcPortPrivileged()
          || resources.isSaslEnabled();

      // Allow secure DataNode to startup if:
      // 1. Http is secure.
      // 2. Rpc is secure
      if (rpcSecured && httpSecured) {
        return;
      }

View on GitHub (pinned to 2add963021)

Solutions

1. Set dfs.block.access.token.enable=true in hdfs-site.xml and push it to ALL nodes (NameNode and DataNodes), then restart the DN
2. Audit every host: hdfs getconf -confKey dfs.block.access.token.enable must print true where DNs run
3. While at it, confirm dfs.block.access.key.update.interval and dfs.block.access.token.lifetime are sane

Example fix

<!-- before: Kerberos on, tokens off -> DN aborts -->
<!-- dfs.block.access.token.enable absent (default false) -->
<!-- after -->
<property><name>dfs.block.access.token.enable</name><value>true</value></property>

boolean kerberos = "kerberos".equalsIgnoreCase(conf.get(CommonConfigurationKeys.HADOOP_SECURITY_AUTHENTICATION));
boolean tokens = conf.getBoolean(DFSConfigKeys.DFS_BLOCK_ACCESS_TOKEN_ENABLE_KEY,
    DFSConfigKeys.DFS_BLOCK_ACCESS_TOKEN_ENABLE_DEFAULT);
if (kerberos && !tokens) {
  throw new IllegalStateException("Kerberos enabled but dfs.block.access.token.enable=false — DN will abort");
}

catch (RuntimeException e) {
  if (e.getMessage().contains("block access tokens")) {
    // set dfs.block.access.token.enable=true in hdfs-site.xml on all nodes and restart the DN
  }
}

When it happens

Trigger: hadoop.security.authentication=kerberos (with the DN in secure mode) while dfs.block.access.token.enable is missing or false in the DN's hdfs-site.xml — typically a partial security rollout where some hosts never received the key.

Common situations: Kerberizing a cluster host-by-host; a distro's minimal hdfs-site.xml lacking the key; test-to-prod config drift; re-enabling security after it was temporarily disabled.

Related errors

• Invalid value configured for dfs.datanode.failed.volumes.tol
• Unable to bind on specified streaming port in secure context
• Unable to bind on specified info port in secure context. Nee
• Server asks us to fall back to SIMPLE auth, but this client
• Security is enabled but block access tokens (via dfs.block.a

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/ad877941ac512d7d. Report an issue: GitHub.