{"record":{"id":"2c805d1e5ee0c558","repo":"t8y2/dbx","slug":"hive-delegation-token-authentication-requires-dele","errorCode":null,"errorMessage":"Hive delegation token authentication requires delegationToken, token, or password","messagePattern":"Hive delegation token authentication requires delegationToken, token, or password","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/argo-go/config.go","lineNumber":741,"sourceCode":"\treturn key\n}\n\nfunc hiveAssignmentValue(values map[string]string, key string) string {\n\tfor candidate, value := range values {\n\t\tif strings.EqualFold(strings.TrimSpace(candidate), key) {\n\t\t\treturn value\n\t\t}\n\t}\n\treturn \"\"\n}\n\nfunc applyDelegationToken(config *connectionConfig, values map[string]string) error {\n\tif !strings.EqualFold(config.Auth, \"DELEGATIONTOKEN\") && !strings.EqualFold(config.Auth, \"DELEGATION_TOKEN\") {\n\t\treturn nil\n\t}\n\ttoken := firstNonEmpty(parameter(values, \"delegationtoken\"), parameter(values, \"token\"), config.Password)\n\tif token == \"\" {\n\t\treturn errors.New(\"Hive delegation token authentication requires delegationToken, token, or password\")\n\t}\n\tconfig.DelegationToken = token\n\tidentifier, password, err := decodeHadoopDelegationToken(token)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"decode Hive delegation token: %w\", err)\n\t}\n\tconfig.Username = base64.StdEncoding.EncodeToString(identifier)\n\tconfig.Password = base64.StdEncoding.EncodeToString(password)\n\treturn nil\n}\n\nfunc decodeHadoopDelegationToken(value string) ([]byte, []byte, error) {\n\tencoded := strings.Join(strings.Fields(strings.TrimSpace(value)), \"\")\n\tif encoded == \"\" {\n\t\treturn nil, nil, errors.New(\"token is empty\")\n\t}\n\tvar decoded []byte\n\tvar decodeErr error","sourceCodeStart":723,"sourceCodeEnd":759,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/argo-go/config.go#L723-L759","documentation":"For DELEGATIONTOKEN / DELEGATION_TOKEN auth, the driver resolves the token from (in order) the delegationToken parameter, the token parameter, or the configured password. If all three are empty, applyDelegationToken returns this error because delegation-token authentication is impossible without a token.","triggerScenarios":"Setting auth=DELEGATIONTOKEN (or DELEGATION_TOKEN) in parameters while leaving delegationToken, token, and password all unset.","commonSituations":"Switching auth to DELEGATIONTOKEN after a JWT/Kerberos setup without providing the token; the token env/parameter name typo'd; the password field cleared by a config refactor.","solutions":["Pass delegationToken=<token> (or token=<token>) in the connection parameters","Set the token via the config Password field if that is how your setup supplies it","Use a different auth scheme if no delegation token is available"],"exampleFix":"// before\njdbc:hive2://host:10000/default?auth=DELEGATIONTOKEN\n// after\njdbc:hive2://host:10000/default?auth=DELEGATIONTOKEN&delegationToken=<base64-token>","handlingStrategy":"validation","validationCode":"if strings.EqualFold(auth, \"DELEGATIONTOKEN\") && delegationToken == \"\" && token == \"\" && password == \"\" {\n    return errors.New(\"DELEGATIONTOKEN auth needs a token\")\n}","typeGuard":null,"tryCatchPattern":"if err := applyDelegationToken(&cfg, values); err != nil {\n    if strings.Contains(err.Error(), \"requires delegationToken\") { /* supply token */ }\n    return err\n}","preventionTips":["Pass the delegation token explicitly via delegationToken= or token=","Keep the password field reserved for real passwords to avoid confusion","Validate the auth scheme/credentials pair before connecting"],"tags":["go","hive","delegation-token","authentication","configuration"],"backgroundTag":"missing-auth-credentials","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}