apache/hadoop · error · IllegalArgumentException

tokenStr cannot be null

Error message

tokenStr cannot be null

What it means

AuthenticatedURL.Token is the holder for the hadoop.auth authentication cookie. The Token(String) constructor requires a string representation obtained earlier (e.g. from a serialized credential) and rejects null immediately with IllegalArgumentException because a null token string has no meaning — there is nothing to restore. This is a fail-fast precondition, not a server interaction.

Source

Thrown at hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/client/AuthenticatedURL.java:190

   */
  public static class Token {

    private final AuthCookieHandler cookieHandler = new AuthCookieHandler();

    /**
     * Creates a token.
     */
    public Token() {
    }

    /**
     * Creates a token using an existing string representation of the token.
     *
     * @param tokenStr string representation of the tokenStr.
     */
    public Token(String tokenStr) {
      if (tokenStr == null) {
        throw new IllegalArgumentException("tokenStr cannot be null");
      }
      set(tokenStr);
    }

    /**
     * Returns if a token from the server has been set.
     *
     * @return if a token from the server has been set.
     */
    public boolean isSet() {
      return cookieHandler.getAuthCookie() != null;
    }

    /**
     * Sets a token.
     *
     * @param tokenStr string representation of the tokenStr.
     */

View on GitHub (pinned to 2add963021)

Solutions

1. Null-check before construction and fall back to fresh authentication: if (tokenStr == null) { authenticator.authenticate(url, new Token()); } else { token = new Token(tokenStr); }
2. Fix the producer that yields null — an optional credential should be an explicit Optional.empty()/absent, not null.
3. Log which source (file/property/UGI credential) was consulted to make the missing-token case diagnosable.
4. When forwarding tokens in distributed jobs, always serialize with Token.toString() on the producer side so the consumer never sees null.

Example fix

// before
Token token = new AuthenticatedURL.Token(tokenStr); // tokenStr may be null

// after
Token token = (tokenStr != null) ? new AuthenticatedURL.Token(tokenStr) : new AuthenticatedURL.Token();
if (!token.isSet()) { authenticator.authenticate(url, token); }

if (tokenStr == null) { authenticator.authenticate(url, token); /* fresh token */ }
else { token = new AuthenticatedURL.Token(tokenStr); }

When it happens

Trigger: Reconstructing a Token from persistence (file, distributed cache, YARN credential transfer, CLI argument) where the source was absent/empty and the loader returned null: new AuthenticatedURL.Token(System.getProperty(...)), token forwarding code that did not check presence first.

Common situations: Passing a token around via command line or config where the variable is optional and unset; a delegated task (MR reducer talking to a web endpoint) receiving credentials only when kerberos is enabled while the code assumes always; refactors that moved token loading after the constructor call.

Related errors

• token cannot be NULL
• url cannot be NULL
• url must be for a HTTP or HTTPS resource
• Authentication failed, URL: {}, status: {}, message: {}
• Invalid SPNEGO sequence, 'WWW-Authenticate' header incorrect

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/ebe2c0284245b3bb. Report an issue: GitHub.