{"record":{"id":"04c4e09e5fa434e0","repo":"apache/hadoop","slug":"can-t-get-master-kerberos-principal-for-use-as-ren","errorCode":null,"errorMessage":"Can't get Master Kerberos principal for use as renewer","messagePattern":"Can't get Master Kerberos principal for use as renewer","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-core/src/main/java/org/apache/hadoop/mapreduce/security/TokenCache.java","lineNumber":134,"sourceCode":"    }\n    return false;\n  }\n\n  /**\n   * get delegation token for a specific FS\n   * @param fs\n   * @param credentials\n   * @param conf\n   * @throws IOException\n   */\n  static void obtainTokensForNamenodesInternal(FileSystem fs,\n      Credentials credentials, Configuration conf, String renewer)\n      throws IOException {\n    // RM skips renewing token with empty renewer\n    String delegTokenRenewer = \"\";\n    if (!isTokenRenewalExcluded(fs, conf)) {\n      if (StringUtils.isEmpty(renewer)) {\n        throw new IOException(\n            \"Can't get Master Kerberos principal for use as renewer\");\n      } else {\n        delegTokenRenewer = renewer;\n      }\n    }\n\n    mergeBinaryTokens(credentials, conf);\n\n    final Token<?> tokens[] = fs.addDelegationTokens(delegTokenRenewer,\n                                                     credentials);\n    if (tokens != null) {\n      for (Token<?> token : tokens) {\n        LOG.info(\"Got dt for \" + fs.getUri() + \"; \"+token);\n      }\n    }\n  }\n\n  private static void mergeBinaryTokens(Credentials creds, Configuration conf) {","sourceCodeStart":116,"sourceCodeEnd":152,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-core/src/main/java/org/apache/hadoop/mapreduce/security/TokenCache.java#L116-L152","documentation":"On Kerberos-enabled clusters, TokenCache.obtainTokensForNamenodesInternal obtains HDFS delegation tokens with the 'master' principal as renewer. The renewer comes from Master.getMasterPrincipal(conf): yarn.resourcemanager.principal in yarn mode, mapreduce.jobtracker.kerberos.principal in classic. If it resolves to empty and the filesystem host is not in mapreduce.job.hdfs-servers.token-renewal.exclude, job submission aborts with this IOException.","triggerScenarios":"Security enabled but the RM (or JT) principal config is missing from the submitting client's configuration; a custom submission tool that builds a bare Configuration without loading *-site.xml; principal key present under a different property name than the framework mode in use.","commonSituations":"Oozie/Shell drivers or SDK clients constructed with new Configuration(true) but missing yarn-site.xml on the classpath; classic-vs-yarn mode mismatch (framework name set but the wrong principal property configured); test rigs submitting from outside the cluster without the cluster's security XML.","solutions":["Set yarn.resourcemanager.principal (yarn) or mapreduce.jobtracker.kerberos.principal (classic) to the service principal in the submitting client's configuration","Confirm the principal value parses (SecurityUtil.getServerPrincipal expands _HOST) and the realm is correct","If the RM should not renew tokens for that filesystem, add its host to mapreduce.job.hdfs-servers.token-renewal.exclude","Ensure the submission tool loads the cluster's core/yarn/mapred site files"],"exampleFix":"// before: bare configuration, no security XML\nConfiguration conf = new Configuration(false);\n// after\nConfiguration conf = new Configuration(true); // loads site files\nconf.set(\"yarn.resourcemanager.principal\", \"rm/_HOST@EXAMPLE.COM\");","handlingStrategy":"validation","validationCode":"if (UserGroupInformation.isSecurityEnabled()) {\n  boolean isYarn = \"yarn\".equals(conf.get(\"mapreduce.framework.name\", \"\"));\n  String principal = isYarn\n      ? conf.get(\"yarn.resourcemanager.principal\")\n      : conf.get(\"mapreduce.jobtracker.kerberos.principal\");\n  if (principal == null || principal.isEmpty()) {\n    throw new IOException(\"RM/JT Kerberos principal not configured; cannot obtain delegation tokens\");\n  }\n}","typeGuard":null,"tryCatchPattern":"try {\n  job.submit();\n} catch (IOException e) {\n  if (e.getMessage() != null && e.getMessage().contains(\"Master Kerberos principal\")) {\n    throw new IOException(\"Submit failed: set yarn.resourcemanager.principal in the client config\", e);\n  }\n  throw e;\n}","preventionTips":["Load the cluster's site files in submission tools instead of bare Configuration objects","Check the framework mode and its matching principal property together in preflight checks","For filesystems the RM must not renew, list them in mapreduce.job.hdfs-servers.token-renewal.exclude"],"tags":["mapreduce","security","kerberos","delegation-token","job-submission","configuration"],"backgroundTag":"missing-kerberos-principal","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}