apache/hadoop · error · IllegalStateException

Tag not found: 0x${tags}

Error message

Tag not found: 0x${tags}

What it means

The DER.get(int... tags) helper inside KerberosUtil navigates a parsed ASN.1/DER structure tag by tag. When an expected tag cannot be found at a position (and no matching element exists in the enclosing sequence), it builds 'Tag not found:' followed by the hex tag path consumed so far and throws IllegalStateException, meaning the token's DER layout does not match the expected Kerberos/SPNEGO shape.

Source

Thrown at hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/util/KerberosUtil.java:421

        }
      }
      return null;
    }

    DER get(int... tags) {
      DER der = this;
      for (int i=0; i < tags.length; i++) {
        int expectedTag = tags[i];
        // lookup for exact match, else scan if it's sequenced.
        if (der.getTag() != expectedTag) {
          der = der.hasNext() ? der.choose(expectedTag) : null;
        }
        if (der == null) {
          StringBuilder sb = new StringBuilder("Tag not found:");
          for (int ii=0; ii <= i; ii++) {
            sb.append(" 0x").append(Integer.toHexString(tags[ii]));
          }
          throw new IllegalStateException(sb.toString());
        }
      }
      return der;
    }

    String getAsString() {
      return new String(bb.array(), bb.arrayOffset() + bb.position(),
          bb.remaining(), StandardCharsets.UTF_8);
    }

    @Override
    public int hashCode() {
      return 31 * tag + bb.hashCode();
    }

    @Override
    public boolean equals(Object o) {
      return (o instanceof DER) &&

View on GitHub (pinned to 2add963021)

Solutions

1. Log the raw token bytes and decode them with a DER tool (openssl asn1parse) to see which element is absent
2. Ensure clients use a standard Kerberos/SPNEGO stack (JGSS, browsers with real Kerberos) rather than custom encoders
3. Catch IllegalStateException around getTokenServerName() and reject the request with 401

Example fix

// before
String server = KerberosUtil.getTokenServerName(rawToken);

// after: treat any DER walk failure as an invalid token
try {
  String server = KerberosUtil.getTokenServerName(rawToken);
} catch (IllegalArgumentException | IllegalStateException e) {
  LOG.debug("Undecodable SPNEGO token", e);
  response.sendError(HttpServletResponse.SC_UNAUTHORIZED);
}

try { server = KerberosUtil.getTokenServerName(raw); } catch (IllegalStateException | IllegalArgumentException e) { /* DER layout unexpected: treat as invalid token, 401 */ }

When it happens

Trigger: getTokenServerName() on a token whose SPNEGO/AP-REQ structure omits an expected element — e.g. negTokenInit without the mech-token element, an AP-REQ missing the ticket field, or bytes that decode as valid DER but of a different layout.

Common situations: Non-standard or future GSS token layouts; partially corrupted token bytes that still parse as DER; hand-crafted test tokens missing optional-but-expected fields.

Related errors

• Malformed gss token
• Not an AP-REQ token
• Invalid SPNEGO sequence, 'WWW-Authenticate' header incorrect
• Invalid SPNEGO sequence, status code: {}
• Security enabled but user not authenticated by filter

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/b73d8381eb63585b. Report an issue: GitHub.