apache/hadoop · error · UnsupportedOperationException

" + this + " login authentication is not supported

Error message

" + this + " login authentication is not supported

What it means

AuthenticationMethod.getLoginAppName() returns the JAAS application name used for login. Only SIMPLE and KERBEROS carry one; TOKEN, CERTIFICATE, KERBEROS_SSL and PROXY are constructed with null and throw UnsupportedOperationException when asked for it. Reached from UGI login internals (HadoopConfiguration) when something attempts a JAAS login under a method that has none.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/UserGroupInformation.java:1497

    
    private final AuthMethod authMethod;
    private final String loginAppName;
    
    private AuthenticationMethod(AuthMethod authMethod) {
      this(authMethod, null);
    }
    private AuthenticationMethod(AuthMethod authMethod, String loginAppName) {
      this.authMethod = authMethod;
      this.loginAppName = loginAppName;
    }
    
    public AuthMethod getAuthMethod() {
      return authMethod;
    }
    
    String getLoginAppName() {
      if (loginAppName == null) {
        throw new UnsupportedOperationException(
            this + " login authentication is not supported");
      }
      return loginAppName;
    }
    
    public static AuthenticationMethod valueOf(AuthMethod authMethod) {
      for (AuthenticationMethod value : values()) {
        if (value.getAuthMethod() == authMethod) {
          return value;
        }
      }
      throw new IllegalArgumentException(
          "no authentication method for " + authMethod);
    }
  };

  /**
   * Create a proxy user using username of the effective user and the ugi of the

View on GitHub (pinned to 2add963021)

Solutions

1. Set hadoop.security.authentication=kerberos in core-site.xml before using login APIs
2. Only call getLoginAppName() (or the login flows behind it) for SIMPLE/KERBEROS
3. Guard enum handling: skip JAAS login for methods without a login app name

Example fix

// before
String app = authMethod.getLoginAppName(); // throws for TOKEN/PROXY/...
// after
String app = (authMethod == AuthenticationMethod.SIMPLE
    || authMethod == AuthenticationMethod.KERBEROS)
        ? authMethod.getLoginAppName() : null;

private static final Set<AuthenticationMethod> JAAS_CAPABLE =
    EnumSet.of(AuthenticationMethod.SIMPLE, AuthenticationMethod.KERBEROS);
if (!JAAS_CAPABLE.contains(authMethod)) {
  throw new UnsupportedOperationException(
      authMethod + " cannot perform JAAS login");
}

static boolean supportsJaasLogin(
    UserGroupInformation.AuthenticationMethod m) {
  return m == UserGroupInformation.AuthenticationMethod.SIMPLE
      || m == UserGroupInformation.AuthenticationMethod.KERBEROS;
}

When it happens

Trigger: Driving UGI's login machinery (getLoginAppName via HadoopConfiguration.getAppConfigurationEntry) while the configured AuthenticationMethod is TOKEN/CERTIFICATE/KERBEROS_SSL/PROXY - e.g., calling loginUserFromKeytab-style flows when hadoop.security.authentication is not kerberos, or calling AuthenticationMethod.TOKEN.getLoginAppName() directly.

Common situations: hadoop.security.authentication=-simple while code assumes keytab login; token/delegation-token services accidentally invoking the Kerberos login path; switch statements over the enum calling getLoginAppName without a guard.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Failed to find user in name " + subject
• no authentication method for " + authMethod
• Illegal principal name " + name + ": " + ioe.toString()
• Problem with Kerberos auth_to_local name configuration
• Invalid attribute value for hadoop.kerberos.min.seconds.befo

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/e8c2483e745e5f30. Report an issue: GitHub.