{"record":{"id":"20b1ffe2676fc5a9","repo":"apache/hadoop","slug":"failed-to-create-secretmanager","errorCode":null,"errorMessage":"Failed to create SecretManager","messagePattern":"Failed to create SecretManager","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"critical","filePath":"hadoop-hdfs-project/hadoop-hdfs-rbf/src/main/java/org/apache/hadoop/hdfs/server/federation/router/security/RouterSecurityManager.java","lineNumber":62,"sourceCode":" * Manager to hold underlying delegation token secret manager implementations.\n */\npublic class RouterSecurityManager {\n\n  private static final Logger LOG =\n      LoggerFactory.getLogger(RouterSecurityManager.class);\n\n  private AbstractDelegationTokenSecretManager<DelegationTokenIdentifier>\n      dtSecretManager = null;\n\n  public RouterSecurityManager(Configuration conf) throws IOException {\n    AuthenticationMethod authMethodConfigured =\n        SecurityUtil.getAuthenticationMethod(conf);\n    AuthenticationMethod authMethodToInit =\n        AuthenticationMethod.KERBEROS;\n    if (authMethodConfigured.equals(authMethodToInit)) {\n      this.dtSecretManager = FederationUtil.newSecretManager(conf);\n      if (this.dtSecretManager == null || !this.dtSecretManager.isRunning()) {\n        throw new IOException(\"Failed to create SecretManager\");\n      }\n    }\n  }\n\n  @VisibleForTesting\n  public RouterSecurityManager(AbstractDelegationTokenSecretManager\n      <DelegationTokenIdentifier> dtSecretManager) {\n    this.dtSecretManager = dtSecretManager;\n  }\n\n  public AbstractDelegationTokenSecretManager<DelegationTokenIdentifier>\n      getSecretManager() {\n    return this.dtSecretManager;\n  }\n\n  public void stop() {\n    LOG.info(\"Stopping security manager\");\n    if(this.dtSecretManager != null) {","sourceCodeStart":44,"sourceCodeEnd":80,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-hdfs-project/hadoop-hdfs-rbf/src/main/java/org/apache/hadoop/hdfs/server/federation/router/security/RouterSecurityManager.java#L44-L80","documentation":"RouterSecurityManager is created when hadoop.security.authentication=kerberos; it instantiates the Router's DelegationTokenSecretManager via FederationUtil.newSecretManager using the class in dfs.federation.router.delegation-token.driver-class. If the returned instance is null (class could not be instantiated) or isRunning() is false (its threads were never started / startThreads failed), the manager cannot issue tokens for the federation, so the constructor throws this IOException and the Router fails to start.","triggerScenarios":"Instantiating RouterSecurityManager with kerberos enabled while the configured token driver class is missing, mistyped, not an AbstractDelegationTokenSecretManager, or throws in its constructor; or the driver (SQL/ZooKeeper-backed impl) constructs but startThreads fails because its backend (MySQL, ZooKeeper) is unreachable — its own wrapper exception surfaces right before this one.","commonSituations":"Switching dfs.federation.router.delegation-token.driver-class to SQLDelegationTokenSecretManagerImpl or ZKDelegationTokenSecretManagerImpl without provisioning the MySQL schema or ZK ensemble; wrong JDBC credentials/URL; ZK connection string wrong; class not on the router classpath after a custom build; MySQL down at router restart with the SQL driver configured.","solutions":["Read the log lines immediately before this exception — FederationUtil.newSecretManager and the driver implementation log the underlying instantiation/startThreads failure (SQL connect error, ZK connect error, ClassNotFoundException).","Fix the backend the token driver depends on: verify MySQL connectivity/credentials/schema or ZooKeeper reachability from the router host.","Verify dfs.federation.router.delegation-token.driver-class names a class on the router classpath that extends AbstractDelegationTokenSecretManager.","If you do not need Router-issued delegation tokens, leave the default driver and ensure kerberos configuration is otherwise complete.","Restart the Router once the backend is healthy — this check runs only at startup."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"// Router startup / tooling that instantiates the security manager:\ntry {\n  RouterSecurityManager sm = new RouterSecurityManager(conf);\n} catch (IOException e) {\n  if (\"Failed to create SecretManager\".equals(e.getMessage())) {\n    // token driver backend (MySQL/ZK) or driver class is broken: fail startup loudly,\n    // check earlier log lines for the underlying instantiation/startThreads error\n    throw new IllegalStateException(\"Router token secret manager unavailable; check \"\n        + \"dfs.federation.router.delegation-token.driver-class backend\", e);\n  }\n  throw e;\n}","preventionTips":["Smoke-test the token driver backend (MySQL connect + schema, ZK ensemble) before starting a kerberos-enabled router.","Keep dfs.federation.router.delegation-token.driver-class under config management and verify the class exists on the router classpath in deploys.","Order startup: backend (ZK/MySQL) first, router second, with a readiness gate."],"tags":["hdfs","router-based-federation","security","delegation-token","kerberos","startup"],"backgroundTag":"delegation-token-secret-manager-init","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}