apache/hadoop · critical · RuntimeException

Undefined property: signature.secret.file

Error message

Undefined property: signature.secret.file

What it means

When HttpFS runs with hadoop-auth authentication enabled, HttpFSAuthenticationFilter.getConfiguration() must find a signature secret (used to sign auth cookies). Unless random-secret mode is active, it requires the property signature.secret.file (exposed as httpfs.authentication.signature.secret.file); if it is absent from the effective configuration, filter initialization throws RuntimeException('Undefined property: signature.secret.file') and the HttpFS webapp fails to deploy.

Source

Thrown at hadoop-hdfs-project/hadoop-hdfs-httpfs/src/main/java/org/apache/hadoop/fs/http/server/HttpFSAuthenticationFilter.java:81

   * <code>hadoop.http.authentication</code>. The
   * <code>hadoop.http.authentication</code> prefix is removed from the
   * returned property names.
   *
   * @param configPrefix parameter not used.
   * @param filterConfig parameter not used.
   *
   * @return hadoop-auth configuration read from HttpFSServer's configuration.
   */
  @Override
  protected Properties getConfiguration(String configPrefix,
      FilterConfig filterConfig) throws ServletException{
    Configuration conf = HttpFSServerWebApp.get().getConfig();
    Properties props = HttpServer2.getFilterProperties(conf,
        new ArrayList<>(Arrays.asList(CONF_PREFIXES)));

    String signatureSecretFile = props.getProperty(SIGNATURE_SECRET_FILE, null);
    if (signatureSecretFile == null) {
      throw new RuntimeException("Undefined property: "
          + SIGNATURE_SECRET_FILE);
    }

    if (!isRandomSecret(filterConfig)) {
      try (Reader reader = new InputStreamReader(Files.newInputStream(
          Paths.get(signatureSecretFile)), StandardCharsets.UTF_8)) {
        StringBuilder secret = new StringBuilder();
        int c = reader.read();
        while (c > -1) {
          secret.append((char) c);
          c = reader.read();
        }

        String secretString = secret.toString();
        if (secretString.isEmpty()) {
          throw new RuntimeException(
              "No secret in HttpFs signature secret file: "
                  + signatureSecretFile);

View on GitHub (pinned to 2add963021)

Solutions

1. Set httpfs.authentication.signature.secret.file in httpfs-site.xml to the absolute path of a file containing a random secret (e.g. generated with openssl rand -base64 32), readable by the httpfs user.
2. Ensure the file exists, is non-empty, and has tight permissions (owner httpfs, mode 400/640) — otherwise you hit the follow-on errors 3643/3644.
3. Alternatively configure a random secret per the hadoop-auth random-secret mechanism (signature.secret.file init-param handled by isRandomSecret) if a per-instance secret is acceptable.
4. If you did not intend to run authenticated, revert httpfs.authentication.type to simple.

Example fix

<!-- before: httpfs-site.xml -->
<property><name>httpfs.authentication.type</name><value>kerberos</value></property>

<!-- after -->
<property><name>httpfs.authentication.type</name><value>kerberos</value></property>
<property><name>httpfs.authentication.signature.secret.file</name><value>/etc/hadoop/security/httpfs-signature-secret</value></property>

# pre-start check
CONF=$(find /etc/hadoop -name httpfs-site.xml)
grep -q 'httpfs.authentication.signature.secret.file' "$CONF" || {
  echo 'FATAL: signature.secret.file not configured'; exit 1; }
grep -A1 'httpfs.authentication.type' "$CONF" | grep -qv simple || exit 0  # simple needs no secret

When it happens

Trigger: Changing httpfs.authentication.type from simple to kerberos/form without also setting httpfs.authentication.signature.secret.file; deploying a new HttpFS node from a template that omits the auth keys; running with a prefix the filter does not read (only httpfs.authentication.* and hadoop.http.* prefixed keys are picked up).

Common situations: Enabling Kerberos or anonymous+simple auth on a cluster where HttpFS was previously running type=simple; config keys misspelled or placed in the wrong file; expecting a default secret file location that does not exist.

Related errors

• No secret in HttpFs signature secret file: {0}
• Could not read HttpFS signature secret file: {0}
• H09
• No COS Credential Providers
• No COS Credentials provided by %s

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/48f7128f65b06340. Report an issue: GitHub.