apache/hadoop · error · IOException

This should not happen: ${ex.getMessage()}

Error message

This should not happen: ${ex.getMessage()}

What it means

Client-side DelegationTokenAuthenticator.cancelDelegationToken only declares IOException, so when the shared doDelegationTokenOperation throws AuthenticationException (server returned an error status via HttpExceptionUtils.validateResponse, or the auth layer failed), cancel wraps it: IOException "This should not happen: <msg>". "Should not happen" because cancellation posts the token itself and normally never exercises authentication - an exception here really means the server rejected the cancel request.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/web/DelegationTokenAuthenticator.java:284

   * being authenticated by the configured <code>Authenticator</code>.
   *
   * @param url the URL to cancel the delegation token from. Only HTTP/S URLs
   * are supported.
   * @param token the authentication token with the Delegation Token to cancel.
   * @param dToken abstract delegation token identifier.
   * @param doAsUser the user to do as, which will be the token owner.
   * @throws IOException if an IO error occurred.
   */
  public void cancelDelegationToken(URL url,
      AuthenticatedURL.Token token,
      Token<AbstractDelegationTokenIdentifier> dToken, String doAsUser)
      throws IOException {
    try {
      doDelegationTokenOperation(url, token,
          DelegationTokenOperation.CANCELDELEGATIONTOKEN, null, dToken, false,
          doAsUser);
    } catch (AuthenticationException ex) {
      throw new IOException("This should not happen: " + ex.getMessage(), ex);
    }
  }

  private Map doDelegationTokenOperation(URL url,
      AuthenticatedURL.Token token, DelegationTokenOperation operation,
      String renewer, Token<?> dToken, boolean hasResponse, String doAsUser)
      throws IOException, AuthenticationException {
    Map ret = null;
    Map<String, String> params = new HashMap<String, String>();
    params.put(OP_PARAM, operation.toString());
    if (renewer != null) {
      params.put(RENEWER_PARAM, renewer);
    }
    if (dToken != null) {
      params.put(TOKEN_PARAM, dToken.encodeToUrlString());
    }
    // proxyuser
    if (doAsUser != null) {

View on GitHub (pinned to 2add963021)

Solutions

1. Unwrap the cause: IOException.getCause() is the AuthenticationException with the server's message (e.g. 404 vs 403 detail).
2. Verify you are canceling a currently-valid token you own (or via an authorized proxyuser) at the URL that issued it.
3. Check the server-side log for the corresponding DelegationTokenAuthenticationHandler entry.
4. Treat already-canceled/expired as success if your workflow only needs the token unusable.

Example fix

// before
try { authUrl.cancelDelegationToken(url, authToken, dt, doAs); }
catch (IOException e) { throw e; }
// after: surface the real server-side reason
try { authUrl.cancelDelegationToken(url, authToken, dt, doAs); }
catch (IOException e) {
  if (e.getCause() instanceof AuthenticationException) {
    LOG.warn("cancel rejected by server: {}", e.getCause().getMessage());
    return; // token unknown/expired -> already effectively canceled
  }
  throw e;
}

try {
  authUrl.cancelDelegationToken(url, authToken, dt, doAs);
} catch (IOException e) {
  if (e.getCause() instanceof AuthenticationException) {
    String msg = e.getCause().getMessage();
    if (msg.contains("404") || msg.contains("unknown")) { /* already invalid: done */ }
    else if (msg.contains("403")) { /* ownership/proxyuser: fix caller identity */ }
    else { throw e; }
  } else { throw e; }
}

When it happens

Trigger: CANCELDELEGATIONTOKEN against a server that answers non-HTTP_OK: token already expired/canceled and unknown to the server, 403 from proxyuser/ownership checks, wrong URL, SPNEGO handshake failure, or a proxy returning an error page.

Common situations: Canceling after the token expired and was removed from the token store; canceling a token owned by another user; pointing the cancel at a non-token-aware endpoint; version mismatch where the server error payload changes.

Related errors

• '%s' did not handle the '%s' delegation token operation: %s
• '%s' did not respond with JSON to the '%s' delegation token
• Could not remove Stored Token ZKDTSMDelegationToken_${sequen
• request UGI cannot be NULL
• %s : %s

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/fa19ae0fe79c4764. Report an issue: GitHub.