{"record":{"id":"1dc2267552354972","repo":"apache/hadoop","slug":"error-in-only-kerberos-based-authentication-is-a","errorCode":null,"errorMessage":"Error in {}Only kerberos based authentication is allowed.","messagePattern":"Error in (.+?)Only kerberos based authentication is allowed\\.","errorType":"exception","errorClass":"AccessControlException","httpStatus":null,"severity":"error","filePath":"hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/datanode/DataNode.java","lineNumber":2420,"sourceCode":"  }\n\n  public DataNodeDiskMetrics getDiskMetrics() {\n    return diskMetrics;\n  }\n  \n  public DataNodePeerMetrics getPeerMetrics() {\n    return peerMetrics;\n  }\n\n  /** Ensure the authentication method is kerberos */\n  private void checkKerberosAuthMethod(String msg) throws IOException {\n    // User invoking the call must be same as the datanode user\n    if (!UserGroupInformation.isSecurityEnabled()) {\n      return;\n    }\n    if (UserGroupInformation.getCurrentUser().getAuthenticationMethod() != \n        AuthenticationMethod.KERBEROS) {\n      throw new AccessControlException(\"Error in \" + msg\n          + \"Only kerberos based authentication is allowed.\");\n    }\n  }\n  \n  private void checkBlockLocalPathAccess() throws IOException {\n    checkKerberosAuthMethod(\"getBlockLocalPathInfo()\");\n    String currentUser = UserGroupInformation.getCurrentUser().getShortUserName();\n    if (!usersWithLocalPathAccess.contains(currentUser)) {\n      throw new AccessControlException(\n          \"Can't continue with getBlockLocalPathInfo() \"\n              + \"authorization. The user \" + currentUser\n              + \" is not configured in \"\n              + DFSConfigKeys.DFS_BLOCK_LOCAL_PATH_ACCESS_USER_KEY);\n    }\n  }\n\n  public long getMaxNumberOfBlocksToLog() {\n    return maxNumberOfBlocksToLog;","sourceCodeStart":2402,"sourceCodeEnd":2438,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/datanode/DataNode.java#L2402-L2438","documentation":"Error \"Error in {}Only kerberos based authentication is allowed.\" thrown in apache/hadoop.","triggerScenarios":"A client or service connects to the DataNode using non-Kerberos authentication while the DataNode is configured to require Kerberos.","commonSituations":"A non-Kerberos authentication attempt hit a cluster in Kerberos-only mode. Configure the client for Kerberos (kinit and hadoop.security.authentication=kerberos).","solutions":["Enable Kerberos (hadoop.security.authentication=kerberos) for the DataNode; simple authentication is rejected for this operation.","Authenticate the caller with Kerberos (kinit) before invoking the operation."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}