apache/hadoop · error · RuntimeException

SignerInitializer class [%s] not found for signer [%s]

Error message

SignerInitializer class [%s] not found for signer [%s]

What it means

When a custom signer entry has three parts, SignerManager loads the third part as an AwsSignerInitializer via ownerConf.getClassByName(parts[2]). If the class cannot be loaded, it wraps the ClassNotFoundException in a RuntimeException naming the missing initializer class and its signer. The initializer is responsible for setting up signer state (e.g. credential stores) before use.

Source

Thrown at hadoop-tools/hadoop-aws/src/main/java/org/apache/hadoop/fs/s3a/auth/SignerManager.java:95

            + " for CustomSigner: [" + customSigner + "]";
        LOG.error(message);
        throw new IllegalArgumentException(message);
      }
      if (parts.length == 1) {
        // Nothing to do. Trying to use a pre-defined Signer
      } else {
        // Register any custom Signer
        maybeRegisterSigner(parts[0], parts[1], ownerConf);

        // If an initializer is specified, take care of instantiating it and
        // setting it up
        if (parts.length == 3) {
          Class<? extends AwsSignerInitializer> clazz = null;
          try {
            clazz = (Class<? extends AwsSignerInitializer>) ownerConf
                .getClassByName(parts[2]);
          } catch (ClassNotFoundException e) {
            throw new RuntimeException(String.format(
                "SignerInitializer class" + " [%s] not found for signer [%s]",
                parts[2], parts[0]), e);
          }
          LOG.debug("Creating signer initializer: [{}] for signer: [{}]",
              parts[2], parts[0]);
          AwsSignerInitializer signerInitializer = ReflectionUtils
              .newInstance(clazz, null);
          initializers.add(signerInitializer);
          signerInitializer
              .registerStore(bucketName, ownerConf, delegationTokenProvider,
                  ownerUgi);
        }
      }
    }
  }

  /**
   * Make sure the signer class is registered once with the AWS SDK.

View on GitHub (pinned to 2add963021)

Solutions

1. Correct the initializer FQCN in the third segment of the fs.s3a.custom.signers entry
2. Ship the jar containing the initializer to every client/executor that opens the s3a filesystem
3. Validate the name resolves in the same classloader context: run a tiny job on the cluster that calls Class.forName on the FQCN

Example fix

<!-- before: initializer package typo -->
<property><name>fs.s3a.custom.signers</name>
  <value>MySigner:com.example.MySigner:com.exmaple.MySignerInit</value></property>

<!-- after -->
<property><name>fs.s3a.custom.signers</name>
  <value>MySigner:com.example.MySigner:com.example.MySignerInit</value></property>

for (String entry : conf.getTrimmedStrings("fs.s3a.custom.signers")) {
  String[] p = entry.split(":");
  if (p.length == 3) {
    conf.getClassByName(p[2]); // fails now with a clear CNFE naming the initializer
  }
}

try {
  fs.initialize(uri, conf);
} catch (RuntimeException e) {
  if (e.getCause() instanceof ClassNotFoundException
      && e.getMessage().contains("SignerInitializer class")) {
    // config/classpath defect: report and stop, no retry
    throw new ConfigException("Missing signer initializer: " + e.getCause().getMessage(), e);
  }
  throw e;
}

When it happens

Trigger: fs.s3a.custom.signers=Name:SignerClass:Initializer where the initializer FQCN is typo'd, the class was moved/renamed in a newer version, or its jar is absent from the classpath of the client initializing the S3A filesystem.

Common situations: Custom signer jar not shipped with the job (missing from Spark --jars/spark.jars, MR -libjars, or the cluster's lib directory); shading relocation changed the package name; version skew between the config template and the deployed jar.

Related errors

• Signer class [%s] not found for signer [%s]
• Decoding S3A token {cause}
• Class {className} {e} (configuration key fs.s3a.http.signer.
• Invalid format (Expected name, name:SignerClass, name:Signer
• Could not find configured fencing method {}

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/61c7b3d379a4a534. Report an issue: GitHub.