{"record":{"id":"1f12c873d3ed9c7e","repo":"apache/hadoop","slug":"the-client-is-configured-to-only-allow-connecting","errorCode":null,"errorMessage":"The client is configured to only allow connecting to secure cluster","messagePattern":"The client is configured to only allow connecting to secure cluster","errorType":"exception","errorClass":"AccessControlException","httpStatus":null,"severity":"error","filePath":"hadoop-hdfs-project/hadoop-hdfs-client/src/main/java/org/apache/hadoop/hdfs/web/WebHdfsFileSystem.java","lineNumber":1869,"sourceCode":"\n  @Override\n  public Token<DelegationTokenIdentifier> getDelegationToken(\n      final String renewer) throws IOException {\n    final HttpOpParam.Op op = GetOpParam.Op.GETDELEGATIONTOKEN;\n    Token<DelegationTokenIdentifier> token =\n        new FsPathResponseRunner<Token<DelegationTokenIdentifier>>(\n            op, null, new RenewerParam(renewer)) {\n          @Override\n          Token<DelegationTokenIdentifier> decodeResponse(Map<?,?> json)\n              throws IOException {\n            return JsonUtilClient.toDelegationToken(json);\n          }\n        }.run();\n    if (token != null) {\n      token.setService(tokenServiceName);\n    } else {\n      if (disallowFallbackToInsecureCluster) {\n        throw new AccessControlException(CANT_FALLBACK_TO_INSECURE_MSG);\n      }\n    }\n    return token;\n  }\n\n  @Override\n  public DelegationTokenIssuer[] getAdditionalTokenIssuers()\n      throws IOException {\n    KeyProvider keyProvider = getKeyProvider();\n    if (keyProvider instanceof DelegationTokenIssuer) {\n      return new DelegationTokenIssuer[] {(DelegationTokenIssuer) keyProvider};\n    }\n    return null;\n  }\n\n  @Override\n  public synchronized Token<?> getRenewToken() {\n    return delegationToken;","sourceCodeStart":1851,"sourceCodeEnd":1887,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-hdfs-project/hadoop-hdfs-client/src/main/java/org/apache/hadoop/hdfs/web/WebHdfsFileSystem.java#L1851-L1887","documentation":"Thrown by WebHdfsFileSystem.getDelegationToken when the server's GETDELEGATIONTOKEN response contains no token (JsonUtilClient.toDelegationToken returned null) and the client is configured to refuse tokenless (insecure) operation. The guard is disallowFallbackToInsecureCluster, set at initialize() to the inverse of ipc.client.fallback-to-simple-auth-allowed (default false, so fallback is disallowed by default). It indicates the client expects a secure cluster but the endpoint it reached cannot issue delegation tokens.","triggerScenarios":"Calling getDelegationToken(renewer) on a WebHdfsFileSystem directly, or indirectly through MapReduce/DistCp/YARN token acquisition (TokenCache.obtainTokens), where the NameNode/HttpFS reply has no token object AND ipc.client.fallback-to-simple-auth-allowed is not true in the client configuration.","commonSituations":"Client core-site.xml has hadoop.security.authentication=kerberos but the WebHDFS/HttpFS endpoint lacks SPNEGO/Kerberos (anonymous HTTP); an httpfs proxy that cannot mint delegation tokens; pointing swebhdfs:// or webhdfs:// at the wrong (insecure) cluster; NN security enabled but the gateway not configured to issue tokens.","solutions":["If connecting to an intentionally insecure cluster, set ipc.client.fallback-to-simple-auth-allowed=true in the client's core-site.xml (this is the flag that controls disallowFallbackToInsecureCluster at WebHdfsFileSystem.java:297)","Otherwise fix the server side so a token is actually issued: enable Kerberos/SPNEGO on the NameNode/HttpFS endpoint (HTTP authentication filter, dfs.web.authentication.* settings) and confirm with a curl --negotiate GETDELEGATIONTOKEN request","Verify the webhdfs:// URL points at the intended cluster/port (9870 HTTP vs 9871 HTTPS) and that you are not silently hitting a standby or different namespace","Ensure UserGroupInformation is logged in via kinit/keytab before the filesystem call so the token request is authenticated"],"exampleFix":"<!-- before: secure client, tokenless server, fallback disallowed by default -->\n<!-- after (only when the insecure cluster is intentional): core-site.xml -->\n<property>\n  <name>ipc.client.fallback-to-simple-auth-allowed</name>\n  <value>true</value>\n</property>","handlingStrategy":"validation","validationCode":"Configuration conf = new Configuration();\nboolean fallbackAllowed = conf.getBoolean(\n    \"ipc.client.fallback-to-simple-auth-allowed\", false);\nboolean securityEnabled = UserGroupInformation.isSecurityEnabled();\nif (securityEnabled && !fallbackAllowed) {\n  // The client will refuse a tokenless server: verify the endpoint can issue\n  // delegation tokens before using it, e.g.\n  // curl --negotiate -u : \"http://nn:9870/webhdfs/v1/?op=GETDELEGATIONTOKEN\"\n  throw new IllegalStateException(\n      \"Secure client + fallback disabled: confirm WebHDFS endpoint is Kerberos-enabled\");\n}","typeGuard":null,"tryCatchPattern":"try {\n  Token<?>[] tokens = fs.addDelegationTokens(renewer, creds);\n} catch (AccessControlException e) {\n  if (WebHdfsFileSystem.CANT_FALLBACK_TO_INSECURE_MSG.equals(e.getMessage())) {\n    // config mismatch, not a permissions problem on the path:\n    // either enable token issuance server-side or set\n    // ipc.client.fallback-to-simple-auth-allowed=true intentionally\n  } else { throw e; }\n}","preventionTips":["Keep hadoop.security.authentication identical on client and WebHDFS/HttpFS server","Decide once per deployment whether fallback-to-simple is allowed and set ipc.client.fallback-to-simple-auth-allowed accordingly","Smoke-test token issuance (GETDELEGATIONTOKEN) whenever security config changes"],"tags":["webhdfs","security","kerberos","delegation-token","authentication"],"backgroundTag":"delegation-token-fallback-blocked","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}