apache/hadoop · error · AccessControlException

Unable to find SASL server implementation for

Error message

Unable to find SASL server implementation for 

What it means

SaslServerFactory.createSaslServer returns null when no registered security provider supplies the requested mechanism (GSSAPI for KERBEROS, DIGEST-MD5 for TOKEN, PLAIN). SaslRpcServer.init registers Hadoop's PLAIN provider via SaslPlainServer.SecurityProvider and relies on the JDK for the rest; if init was never called or the JVM lacks the matching SaslServerFactory, create throws AccessControlException naming the mechanism.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SaslRpcServer.java:169

            "Server does not support SASL " + authMethod);
    }
    
    final SaslServer saslServer;
    if (ugi != null) {
      saslServer = ugi.doAs(
        new PrivilegedExceptionAction<SaslServer>() {
          @Override
          public SaslServer run() throws SaslException  {
            return saslFactory.createSaslServer(mechanism, protocol, serverId,
                saslProperties, callback);
          }
        });
    } else {
      saslServer = saslFactory.createSaslServer(mechanism, protocol, serverId,
          saslProperties, callback);
    }
    if (saslServer == null) {
      throw new AccessControlException(
          "Unable to find SASL server implementation for " + mechanism);
    }
    if (LOG.isDebugEnabled()) {
      LOG.debug("Created SASL server with mechanism = " + mechanism);
    }
    return saslServer;
  }

  public static void init(Configuration conf) {
    if (saslFactory == null) {
      Security.addProvider(new SaslPlainServer.SecurityProvider());
      // passing null so factory is populated with all possibilities. the
      // properties passed when instantiating a server are what really matter
      saslFactory = new FastSaslServerFactory(null);
    }
  }
  
  static String encodeIdentifier(byte[] identifier) {

View on GitHub (pinned to 2add963021)

Solutions

1. Call SaslRpcServer.init(conf) once before creating any SASL server (Hadoop daemons do this during startup)
2. Verify the JVM's java.security provider list still contains the SunSASL and GSS providers on the failing node
3. Run the full JDK (not a minimized JRE) on all cluster nodes
4. For custom mechanisms, register a SaslServerFactory via a SecurityProvider like SaslPlainServer.SecurityProvider

SaslRpcServer.init(conf); // ensure Hadoop's PLAIN provider is registered first
javax.security.sasl.SaslServer probe =
    Sasl.createSaslServer("GSSAPI", "hdfs", "localhost", null, null);
if (probe == null) {
  throw new IllegalStateException("No SASL provider for GSSAPI on this JVM");
}

When it happens

Trigger: SaslRpcServer.create is invoked with a mechanism no provider implements: SaslRpcServer.init(conf) was skipped before create, the JVM is a stripped/hardened JRE whose java.security pruned the SunSASL or GSS providers, or a custom mechanism name was negotiated that no SaslServerFactory covers.

Common situations: Embedded mini-clusters or unit tests that build a SASL server without calling SaslRpcServer.init; exotic or container-minimized JVMs; custom SASL plugins removed from the classpath but still negotiated by the peer.

Related errors

• Kerberos principal name does NOT have the expected hostname
• ${theClass.getName()} could not be constructed.
• numLevels must be at least 1
• callqueue.capacity.weights must specify ${priorityLevels} ca
• callqueue.capacity.weights only takes positive weights. ${w}

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/4adfaa8306db6c30. Report an issue: GitHub.