apache/hadoop · error · AccessControlException

The client is configured to only allow connecting to secure

Error message

The client is configured to only allow connecting to secure cluster

What it means

Thrown by WebHdfsFileSystem.getDelegationToken when the server's GETDELEGATIONTOKEN response contains no token (JsonUtilClient.toDelegationToken returned null) and the client is configured to refuse tokenless (insecure) operation. The guard is disallowFallbackToInsecureCluster, set at initialize() to the inverse of ipc.client.fallback-to-simple-auth-allowed (default false, so fallback is disallowed by default). It indicates the client expects a secure cluster but the endpoint it reached cannot issue delegation tokens.

Source

Thrown at hadoop-hdfs-project/hadoop-hdfs-client/src/main/java/org/apache/hadoop/hdfs/web/WebHdfsFileSystem.java:1869

  @Override
  public Token<DelegationTokenIdentifier> getDelegationToken(
      final String renewer) throws IOException {
    final HttpOpParam.Op op = GetOpParam.Op.GETDELEGATIONTOKEN;
    Token<DelegationTokenIdentifier> token =
        new FsPathResponseRunner<Token<DelegationTokenIdentifier>>(
            op, null, new RenewerParam(renewer)) {
          @Override
          Token<DelegationTokenIdentifier> decodeResponse(Map<?,?> json)
              throws IOException {
            return JsonUtilClient.toDelegationToken(json);
          }
        }.run();
    if (token != null) {
      token.setService(tokenServiceName);
    } else {
      if (disallowFallbackToInsecureCluster) {
        throw new AccessControlException(CANT_FALLBACK_TO_INSECURE_MSG);
      }
    }
    return token;
  }

  @Override
  public DelegationTokenIssuer[] getAdditionalTokenIssuers()
      throws IOException {
    KeyProvider keyProvider = getKeyProvider();
    if (keyProvider instanceof DelegationTokenIssuer) {
      return new DelegationTokenIssuer[] {(DelegationTokenIssuer) keyProvider};
    }
    return null;
  }

  @Override
  public synchronized Token<?> getRenewToken() {
    return delegationToken;

View on GitHub (pinned to 2add963021)

Solutions

1. If connecting to an intentionally insecure cluster, set ipc.client.fallback-to-simple-auth-allowed=true in the client's core-site.xml (this is the flag that controls disallowFallbackToInsecureCluster at WebHdfsFileSystem.java:297)
2. Otherwise fix the server side so a token is actually issued: enable Kerberos/SPNEGO on the NameNode/HttpFS endpoint (HTTP authentication filter, dfs.web.authentication.* settings) and confirm with a curl --negotiate GETDELEGATIONTOKEN request
3. Verify the webhdfs:// URL points at the intended cluster/port (9870 HTTP vs 9871 HTTPS) and that you are not silently hitting a standby or different namespace
4. Ensure UserGroupInformation is logged in via kinit/keytab before the filesystem call so the token request is authenticated

Example fix

<!-- before: secure client, tokenless server, fallback disallowed by default -->
<!-- after (only when the insecure cluster is intentional): core-site.xml -->
<property>
  <name>ipc.client.fallback-to-simple-auth-allowed</name>
  <value>true</value>
</property>

Configuration conf = new Configuration();
boolean fallbackAllowed = conf.getBoolean(
    "ipc.client.fallback-to-simple-auth-allowed", false);
boolean securityEnabled = UserGroupInformation.isSecurityEnabled();
if (securityEnabled && !fallbackAllowed) {
  // The client will refuse a tokenless server: verify the endpoint can issue
  // delegation tokens before using it, e.g.
  // curl --negotiate -u : "http://nn:9870/webhdfs/v1/?op=GETDELEGATIONTOKEN"
  throw new IllegalStateException(
      "Secure client + fallback disabled: confirm WebHDFS endpoint is Kerberos-enabled");
}

try {
  Token<?>[] tokens = fs.addDelegationTokens(renewer, creds);
} catch (AccessControlException e) {
  if (WebHdfsFileSystem.CANT_FALLBACK_TO_INSECURE_MSG.equals(e.getMessage())) {
    // config mismatch, not a permissions problem on the path:
    // either enable token issuance server-side or set
    // ipc.client.fallback-to-simple-auth-allowed=true intentionally
  } else { throw e; }
}

When it happens

Trigger: Calling getDelegationToken(renewer) on a WebHdfsFileSystem directly, or indirectly through MapReduce/DistCp/YARN token acquisition (TokenCache.obtainTokens), where the NameNode/HttpFS reply has no token object AND ipc.client.fallback-to-simple-auth-allowed is not true in the client configuration.

Common situations: Client core-site.xml has hadoop.security.authentication=kerberos but the WebHDFS/HttpFS endpoint lacks SPNEGO/Kerberos (anonymous HTTP); an httpfs proxy that cannot mint delegation tokens; pointing swebhdfs:// or webhdfs:// at the wrong (insecure) cluster; NN security enabled but the gateway not configured to issue tokens.

Related errors

• {} parameter is not null.
• Failed to obtain user group information: {}
• Delegation Token can be issued only with kerberos or web aut
• Delegation Token can be renewed only with kerberos or web au
• Server asks us to fall back to SIMPLE auth, but this client

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/1f12c873d3ed9c7e. Report an issue: GitHub.