What causes "Unknown authentication type: %s" in apache/hadoop?

Use one of the six exact enum values for fs.gs.auth.type / google.cloud.auth.type.

apache/hadoop · error · IllegalArgumentException

Unknown authentication type: %s

Error message

Unknown authentication type: %s

What it means

The default branch of the auth switch in HadoopCredentialsConfiguration.getCredentials: the configured AuthenticationType does not correspond to any handled constant. Handled values are APPLICATION_DEFAULT, COMPUTE_ENGINE, SERVICE_ACCOUNT_JSON_KEYFILE, WORKLOAD_IDENTITY_FEDERATION_CREDENTIAL_CONFIG_FILE, UNAUTHENTICATED, USER_CREDENTIALS. Hadoop's Configuration.getEnum normally rejects unknown strings earlier with its own error, so this fires mainly for null/unresolvable values that slip into the switch.

Source

Thrown at hadoop-cloud-storage-project/hadoop-gcp/src/main/java/org/apache/hadoop/fs/gs/HadoopCredentialsConfiguration.java:175

      return UserCredentials.newBuilder()
              .setClientId(clientId)
              .setClientSecret(clientSecret.getValue())
              .setRefreshToken(refreshToken.getValue())
              .build();

    case WORKLOAD_IDENTITY_FEDERATION_CREDENTIAL_CONFIG_FILE:
      String configFile =
              WORKLOAD_IDENTITY_FEDERATION_CREDENTIAL_CONFIG_FILE_SUFFIX
                      .withPrefixes(keyPrefixes)
                      .get(config, config::get);
      try (FileInputStream fis = new FileInputStream(configFile)) {
        return ExternalAccountCredentials.fromStream(fis);
      }
    case UNAUTHENTICATED:
      return null;
    default:
      throw new IllegalArgumentException("Unknown authentication type: " + authenticationType);
    }
  }

  private static GoogleCredentials configureCredentials(
          Configuration config, List<String> keyPrefixes, GoogleCredentials credentials) {
    credentials = credentials.createScoped(CLOUD_PLATFORM_SCOPE);
    String tokenServerUrl =
            TOKEN_SERVER_URL_SUFFIX.withPrefixes(keyPrefixes).get(config, config::get);
    if (tokenServerUrl == null) {
      return credentials;
    }
    if (credentials instanceof ServiceAccountCredentials) {
      return ((ServiceAccountCredentials) credentials)
              .toBuilder().setTokenServerUri(URI.create(tokenServerUrl)).build();
    }
    if (credentials instanceof UserCredentials) {
      return ((UserCredentials) credentials)
              .toBuilder().setTokenServerUri(URI.create(tokenServerUrl)).build();

View on GitHub (pinned to 2add963021)

Solutions

Use one of the six exact enum values for fs.gs.auth.type / google.cloud.auth.type.
If you do not need explicit auth config, remove the property to fall back to the built-in default (COMPUTE_ENGINE).
Double-check spelling/case - the value must match the enum constant exactly.

Example fix

<!-- before -->
<property><name>fs.gs.auth.type</name><value>SERVICE_ACCOUNT</value></property> <!-- not an enum value -->

<!-- after -->
<property><name>fs.gs.auth.type</name><value>SERVICE_ACCOUNT_JSON_KEYFILE</value></property>

Defensive patterns

Strategy: validation

Validate before calling

Set<String> valid = Set.of("APPLICATION_DEFAULT", "COMPUTE_ENGINE", "SERVICE_ACCOUNT_JSON_KEYFILE",
    "WORKLOAD_IDENTITY_FEDERATION_CREDENTIAL_CONFIG_FILE", "UNAUTHENTICATED", "USER_CREDENTIALS");
String t = conf.get("fs.gs.auth.type");
if (t != null && !valid.contains(t)) {
  throw new IllegalArgumentException("Invalid fs.gs.auth.type: " + t + "; valid: " + valid);
}

Try / catch

catch IllegalArgumentException with message startsWith("Unknown authentication type") (or Configuration.getEnum's own 'Not a enum value' error) - correct the property to one of the six enum constants or unset it to use the default.

Prevention

Copy auth type values from the connector's AuthenticationType enum, not from other tools' docs.
After upgrading the connector, re-verify configured enum names still exist.

When it happens

Trigger: The auth type property resolves to a value outside the AuthenticationType enum (e.g. 'SERVICE_ACCOUNT' from another connector, or a null after config manipulation), and getEnum passes it through to the switch's default branch.

Common situations: Version upgrades where old auth type constant names were removed/renamed; configs copied from other GCS tools (gcloud, bigquery connector) with different type names; programmatic Configuration edits clearing or corrupting fs.gs.auth.type.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/107fe6ad7a1b76a0. Report an issue: GitHub.