apache/hadoop · error · ServiceStateException

Unknown/unsupported authentication mechanism; "{}"

Error message

Unknown/unsupported authentication mechanism; "{}"

What it means

RegistrySecurity maps the hadoop.registry.client.auth configuration to an internal AccessPolicy. Only four spellings are accepted: '' (anonymous), 'simple', 'kerberos' (SASL) and 'digest'. Any other value falls to the default branch of the switch and throws ServiceStateException('Unknown/unsupported authentication mechanism; "<value>"') with the offending value quoted so the bad setting is obvious.

Source

Thrown at hadoop-common-project/hadoop-registry/src/main/java/org/apache/hadoop/registry/client/impl/zk/RegistrySecurity.java:219

    super.serviceInit(conf);
    String auth = conf.getTrimmed(KEY_REGISTRY_CLIENT_AUTH,
        REGISTRY_CLIENT_AUTH_ANONYMOUS);

    switch (auth) {
    case REGISTRY_CLIENT_AUTH_KERBEROS:
      access = AccessPolicy.sasl;
      break;
    case REGISTRY_CLIENT_AUTH_DIGEST:
      access = AccessPolicy.digest;
      break;
    case REGISTRY_CLIENT_AUTH_ANONYMOUS:
      access = AccessPolicy.anon;
      break;
    case REGISTRY_CLIENT_AUTH_SIMPLE:
      access = AccessPolicy.simple;
      break;
    default:
      throw new ServiceStateException(E_UNKNOWN_AUTHENTICATION_MECHANISM
                                      + "\"" + auth + "\"");
    }
    initSecurity();
  }

  /**
   * Init security.
   *
   * After this operation, the {@link #systemACLs} list is valid.
   * @throws IOException
   */
  private void initSecurity() throws IOException {

    secureRegistry =
        getConfig().getBoolean(KEY_REGISTRY_SECURE, DEFAULT_REGISTRY_SECURE);
    systemACLs.clear();
    if (secureRegistry) {
      addSystemACL(ALL_READ_ACCESS);

View on GitHub (pinned to 2add963021)

Solutions

1. Set hadoop.registry.client.auth to one of '', 'simple', 'kerberos', 'digest'.
2. Prefer RegistryOperationsFactory.createAnonymousInstance/createKerberosInstance/createAuthenticatedInstance, which set this key correctly for you.
3. Add a startup validation of the value against the four accepted spellings so the mistake fails fast with a clear message.

Example fix

// before
conf.set("hadoop.registry.client.auth", "sasl"); // unsupported spelling -> ServiceStateException

// after: accepted values are "", "simple", "kerberos", "digest" — or use the factory
RegistryOperations ops = RegistryOperationsFactory.createKerberosInstance(conf, principal, keytab);

Set<String> accepted = new HashSet<>(Arrays.asList("", "simple", "kerberos", "digest"));
String auth = conf.get("hadoop.registry.client.auth", "");
if (!accepted.contains(auth)) {
  throw new IllegalArgumentException(
      "hadoop.registry.client.auth must be one of '', 'simple', 'kerberos', 'digest': got '" + auth + "'");
}
RegistryOperations ops = RegistryOperationsFactory.createAnonymousInstance(conf); // or the matching factory method

try {
  RegistryOperations ops = RegistryOperationsFactory.createKerberosInstance(conf, principal, keytab);
} catch (ServiceStateException e) {
  // message quotes the bad auth value: fix hadoop.registry.client.auth and retry
}

When it happens

Trigger: hadoop.registry.client.auth set to an unrecognized string such as 'sasl' (the spelling many other ZK clients use), 'none', 'DIGEST' (case-sensitive), 'anonymous', or a typo.

Common situations: Hand-editing registry client configuration; porting settings from other ZooKeeper clients where 'sasl' is the conventional value; case mismatches and typos in XML config files.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Missing value for configuration option {}
• Kerberos required for secure registry access
• No user for ACLs determinable from current user or registry
• ACL '{}' not of expected form scheme:id
• Parsing {} :{}

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/1ba3807720092406. Report an issue: GitHub.