apache/hadoop · critical · RuntimeException

Unable to bind on specified info port in secure context. Nee

Error message

Unable to bind on specified info port in secure context. Needed {}, got {}

What it means

Secure (jsvc) startup binds the DataNode HTTP info server socket and verifies the bound port equals the configured dfs.datanode.http.address port. If they differ (in practice, the configured info port is 0 so an ephemeral port was assigned), it throws this RuntimeException: in secure context the HTTP(S) port must be fixed so clients can authenticate the server. Note the message has a known cosmetic bug - the 'got' value printed is ss.getLocalPort() (the streaming port), not the HTTP port actually bound.

Source

Thrown at hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/datanode/SecureDataNodeStarter.java:168

    // Bind a port for the web server. The code intends to bind HTTP server to
    // privileged port only, as the client can authenticate the server using
    // certificates if they are communicating through SSL.
    final ServerSocketChannel httpChannel;
    if (policy.isHttpEnabled()) {
      httpChannel = ServerSocketChannel.open();
      InetSocketAddress infoSocAddr = DataNode.getInfoAddr(conf);
      try {
        httpChannel.socket().bind(infoSocAddr);
      } catch (BindException e) {
        BindException newBe = appendMessageToBindException(e,
            infoSocAddr.toString());
        throw newBe;
      }
      InetSocketAddress localAddr = (InetSocketAddress) httpChannel.socket()
        .getLocalSocketAddress();

      if (localAddr.getPort() != infoSocAddr.getPort()) {
        throw new RuntimeException("Unable to bind on specified info port in " +
            "secure context. Needed " + infoSocAddr.getPort() + ", got " +
             ss.getLocalPort());
      }
      System.err.println("Successfully obtained privileged resources (streaming port = "
          + ss + " ) (http listener port = " + localAddr.getPort() +")");

      isHttpPrivileged = SecurityUtil.isPrivilegedPort(localAddr.getPort());
      System.err.println("Opened info server at " + infoSocAddr);
    } else {
      httpChannel = null;
    }

    return new SecureResources(ss, httpChannel, isSaslEnabled,
        isRpcPrivileged, isHttpPrivileged);
  }

  private static BindException appendMessageToBindException(BindException e,
      String msg) {

View on GitHub (pinned to 2add963021)

Solutions

1. Set a fixed info port: dfs.datanode.http.address=0.0.0.0:9864 (and/or dfs.datanode.https.address=0.0.0.0:9865 when dfs.http.policy is HTTPS_ONLY), restart under jsvc
2. If you do not want an HTTP server, set dfs.http.policy=HTTPS_ONLY and configure https.address with a concrete port rather than relying on port 0
3. Read the 'Needed' value in the message as the port to configure; ignore the misleading 'got' number (it echoes the streaming port due to the printing bug)

Example fix

# before (hdfs-site.xml)
<property><name>dfs.datanode.http.address</name><value>0.0.0.0:0</value></property>

# after
<property><name>dfs.datanode.http.address</name><value>0.0.0.0:9864</value></property>

void assertFixedInfoPort(Configuration conf) {
  String http = conf.get("dfs.datanode.http.address", "0.0.0.0:9864");
  String https = conf.get("dfs.datanode.https.address", "0.0.0.0:9865");
  for (String v : new String[]{http, https}) {
    int port = Integer.parseInt(v.substring(v.lastIndexOf(':') + 1));
    if (port == 0) throw new IllegalStateException(
        "Secure mode requires a fixed datanode info port: " + v);
  }
}

When it happens

Trigger: jsvc secure startup with HTTP policy enabled (dfs.http.policy HTTP_ONLY or HTTPS_ONLY) while dfs.datanode.http.address (or dfs.datanode.https.address per policy) has port 0; httpChannel.socket().bind() then takes an ephemeral port and localAddr.getPort() != infoSocAddr.getPort().

Common situations: Default/inherited config with dfs.datanode.http.address=0.0.0.0:0 (or :50475 for https left at 0 semantics) carried into a secure deployment; admins disabling the info port deliberately with port 0 but leaving HTTP policy enabled instead of switching policy off.

Related errors

• Unable to bind on specified streaming port in secure context
• Security is enabled but block access tokens (via dfs.block.a
• Failed to create SecretManager
• Fetch of delegation token failed
• Cannot create a secured connection if DataNode listens on un

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/86ea72eee703f217. Report an issue: GitHub.