apache/hadoop · error · IllegalArgumentException

The configuration does not define the token kind

Error message

The configuration does not define the token kind

What it means

initTokenManager() builds a DelegationTokenManager from the filter properties: every property is copied into a Configuration, then conf.get("delegation-token.token-kind") (DelegationTokenAuthenticationHandler.TOKEN_KIND) must return the Text kind stamped on issued tokens. A null value throws IllegalArgumentException "The configuration does not define the token kind" during handler init, failing the whole auth filter.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/web/DelegationTokenAuthenticationHandler.java:157

   * services.
   *
   * @param secretManager a <code>DelegationTokenSecretManager</code> instance
   */
  public void setExternalDelegationTokenSecretManager(
      AbstractDelegationTokenSecretManager secretManager) {
    tokenManager.setExternalDelegationTokenSecretManager(secretManager);
  }

  @VisibleForTesting
  @SuppressWarnings("unchecked")
  public void initTokenManager(Properties config) {
    Configuration conf = new Configuration(false);
    for (Map.Entry entry : config.entrySet()) {
      conf.set((String) entry.getKey(), (String) entry.getValue());
    }
    String tokenKind = conf.get(TOKEN_KIND);
    if (tokenKind == null) {
      throw new IllegalArgumentException(
          "The configuration does not define the token kind");
    }
    tokenKind = tokenKind.trim();
    tokenManager = new DelegationTokenManager(conf, new Text(tokenKind));
    tokenManager.init();
  }

  @VisibleForTesting
  public void initJsonFactory(Properties config) {
    boolean hasFeature = false;
    JsonFactory tmpJsonFactory = new JsonFactory();

    for (Map.Entry entry : config.entrySet()) {
      String key = (String)entry.getKey();
      if (key.startsWith(JSON_MAPPER_PREFIX)) {
        JsonGenerator.Feature feature =
            JsonGenerator.Feature.valueOf(key.substring(JSON_MAPPER_PREFIX
                .length()));

View on GitHub (pinned to 2add963021)

Solutions

1. Add <auth-prefix>.delegation-token.token-kind=<KIND> (e.g. hadoop.http.authentication.delegation-token.token-kind=WEBHDFS) matching the token kind clients expect.
2. Set the same kind on every HA node and on fronting gateways (HttpFS/KMS) so tokens interoperate.
3. Restart the web service so the handler re-initializes.

Example fix

<!-- before -->
<property>
  <name>hadoop.http.authentication.type</name>
  <value>kerberos</value>
</property>
<!-- after -->
<property>
  <name>hadoop.http.authentication.type</name>
  <value>kerberos</value>
</property>
<property>
  <name>hadoop.http.authentication.delegation-token.token-kind</name>
  <value>WEBHDFS</value>
</property>

// Deploy-time check: token kind must be set wherever the DT filter is deployed
String kind = conf.get("hadoop.http.authentication.delegation-token.token-kind");
if (kind == null || kind.trim().isEmpty()) {
  throw new IllegalArgumentException("token-kind missing under the auth prefix");
}

When it happens

Trigger: Deploying the DelegationTokenAuthenticationFilter without "<auth-prefix>.delegation-token.token-kind" in its config (e.g. hadoop.http.authentication.delegation-token.token-kind, hadoop.kms.authentication.delegation-token.token-kind); the property exists but under the wrong prefix or misspelled (tokenKind vs token-kind), so the trimmed lookup returns null.

Common situations: Upgrading to Hadoop versions where the kind became configurable and must match what clients validate (WEBHDFS, HDFS_DELEGATION_TOKEN, kms sort); KMS/WebHDFS sites with custom prefixes; hand-written filter configs that only set type/signer properties.

Related errors

• No COS Credential Providers
• No COS Credentials provided by %s
• Missing keyfile property ('%s') for authentication type '%s'
• Unknown authentication type: %s
• Server asks us to fall back to SIMPLE auth, but this client

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/b5180a524a8cc59c. Report an issue: GitHub.