apache/hadoop · error · AccessControlException

Server asks us to fall back to SIMPLE auth, but this client

Error message

Server asks us to fall back to SIMPLE auth, but this client is configured to only allow secure connections.

What it means

During SASL negotiation, the server told this client to fall back to SIMPLE authentication while the client JVM runs with Kerberos security enabled (UserGroupInformation.isSecurityEnabled()). Because ipc.client.fallback-to-simple-auth-allowed defaults to false, the client refuses and throws AccessControlException rather than silently downgrading to an unauthenticated connection.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/ipc/Client.java:928

        return;
      }
      if (fallbackToSimpleAuth == null) {
        // this should happen only during testing.
        LOG.trace("Connection {} will skip to set fallbackToSimpleAuth as it is null.", remoteId);
      } else {
        if (fallbackToSimpleAuth.get()) {
          // we already set the value to true, we do not need to examine again.
          return;
        }
      }
      if (authMethod != AuthMethod.SIMPLE) {
        if (fallbackToSimpleAuth != null) {
          LOG.trace("Disabling fallbackToSimpleAuth, target does not use SIMPLE authentication.");
          fallbackToSimpleAuth.set(false);
        }
      } else if (UserGroupInformation.isSecurityEnabled()) {
        if (!fallbackAllowed) {
          throw new AccessControlException("Server asks us to fall back to SIMPLE auth, but this "
              + "client is configured to only allow secure connections.");
        }
        if (fallbackToSimpleAuth != null) {
          LOG.trace("Enabling fallbackToSimpleAuth for target, as we are allowed to fall back.");
          fallbackToSimpleAuth.set(true);
        }
      }
    }

    private void closeConnection() {
      if (socket == null) {
        return;
      }
      // close the current connection
      try {
        socket.close();
      } catch (IOException e) {
        LOG.warn("Not able to close a socket", e);

View on GitHub (pinned to 2add963021)

Solutions

If falling back is acceptable, set ipc.client.fallback-to-simple-auth-allowed=true on the CLIENT configuration (core-site.xml of the connecting process).
Preferably, Kerberize the target server so client and server auth methods match.
Check which endpoint is answering: the 'server' may actually be an unsecured proxy or a wrong-addressed daemon (verify port/host).
Confirm hadoop.security.authentication is intentionally different on the two sides; align it if both should be secure.

Example fix

# before (client core-site.xml)
<!-- nothing set; default ipc.client.fallback-to-simple-auth-allowed=false -->

# after
<property>
  <name>ipc.client.fallback-to-simple-auth-allowed</name>
  <value>true</value>
</property>

Defensive patterns

Strategy: fallback

Validate before calling

// before issuing calls to a possibly-unsecured server:
boolean securityEnabled = "kerberos".equals(conf.get("hadoop.security.authentication"));
if (securityEnabled) {
  conf.setBoolean("ipc.client.fallback-to-simple-auth-allowed", true); // only if policy permits plaintext
}

Try / catch

try {
  call();
} catch (AccessControlException e) {
  if (e.getMessage() != null && e.getMessage().contains("fall back to SIMPLE auth")) {
    // decide: enable fallback config, or stop talking to this unsecured endpoint
    throw new SecurityException("Refusing unsecured endpoint: " + server, e);
  }
  throw e;
}

Prevention

Kerberize all endpoints a secure client must contact, including auxiliary/gateway services.
Set ipc.client.fallback-to-simple-auth-allowed explicitly (true or false) so intent is recorded.
Verify the target host:port really is the intended daemon — misrouted connections look like auth mismatches.
Keep hadoop.security.authentication consistent across the tier during migrations.

When it happens

Trigger: A Kerberos-enabled client (hadoop.security.authentication=kerberos) connecting to a service still running SIMPLE auth (no Kerberos on the server, e.g., an unsecured stand-by or a misconfigured gateway), with ipc.client.fallback-to-simple-auth-allowed unset/false; common when secure clusters talk to unsecured auxiliary services.

Common situations: Partially migrated clusters where some daemons are Kerberized and others are not; distcp/HDFS clients in a secure realm hitting a non-secure test cluster; Knox/gateway hops stripping SASL; config drift of hadoop.security.authentication between client and server.

Related errors

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/ddfb38db75f9ca34. Report an issue: GitHub.