{"record":{"id":"334a162a6f82bd0e","repo":"t8y2/dbx","slug":"identifier-w","errorCode":null,"errorMessage":"identifier: %w","messagePattern":"identifier: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/argo-go/config.go","lineNumber":777,"sourceCode":"\tvar decodeErr error\n\tfor _, encoding := range []*base64.Encoding{\n\t\tbase64.RawURLEncoding,\n\t\tbase64.URLEncoding,\n\t\tbase64.RawStdEncoding,\n\t\tbase64.StdEncoding,\n\t} {\n\t\tdecoded, decodeErr = encoding.DecodeString(encoded)\n\t\tif decodeErr == nil {\n\t\t\tbreak\n\t\t}\n\t}\n\tif decodeErr != nil {\n\t\treturn nil, nil, decodeErr\n\t}\n\treader := strings.NewReader(string(decoded))\n\tidentifier, err := readHadoopByteArray(reader)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"identifier: %w\", err)\n\t}\n\tpassword, err := readHadoopByteArray(reader)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"password: %w\", err)\n\t}\n\tif len(identifier) == 0 || len(password) == 0 {\n\t\treturn nil, nil, errors.New(\"token identifier and password must be non-empty\")\n\t}\n\tif _, err := readHadoopByteArray(reader); err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"kind: %w\", err)\n\t}\n\tif _, err := readHadoopByteArray(reader); err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"service: %w\", err)\n\t}\n\tif reader.Len() != 0 {\n\t\treturn nil, nil, errors.New(\"token contains trailing data\")\n\t}\n\treturn identifier, password, nil","sourceCodeStart":759,"sourceCodeEnd":795,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/argo-go/config.go#L759-L795","documentation":"This error is returned while parsing a Hadoop delegation token: the first length-prefixed byte array (the token identifier) could not be read. It is wrapped by the outer 'decode Hive delegation token' error. It means the token stream is truncated or the length-prefix encoding is corrupt at the identifier field.","triggerScenarios":"Decoding a delegation token whose base64 payload ends before the identifier field can be fully read, or whose leading VInt length cannot be decoded.","commonSituations":"Truncated token (copy/paste cut off mid-string); token mangled by newline/whitespace stripping; token built by an incompatible Hadoop version using a different wire format.","solutions":["Re-copy the full delegation token and verify its length before use","Regenerate the token from the Hive server","Confirm the token is a Hadoop delegation token, not another credential type","Check that the secret store or config did not strip characters from the token"],"exampleFix":"// before\ntoken := cfg.Password // truncated copy-paste\n// after\ntoken := loadFullTokenFromSecretStore() // complete base64 token","handlingStrategy":"validation","validationCode":"func tokenLooksComplete(token string) error {\n\tdecoded, err := base64.StdEncoding.DecodeString(token)\n\tif err != nil { return err }\n\tif len(decoded) < 16 { return errors.New(\"token truncated: too short\") }\n\treturn nil\n}","typeGuard":null,"tryCatchPattern":"_, _, err := decodeHadoopDelegationToken(token)\nif err != nil {\n\tif strings.Contains(err.Error(), \"identifier\") {\n\t\tlog.Println(\"token malformed at identifier field — re-fetch token\")\n\t}\n\treturn err\n}","preventionTips":["Copy tokens without truncation; verify length against the source","Avoid extracting tokens from wrapped log output","Store the token as a single unbroken string","Regenerate tokens rather than repairing partial ones"],"tags":["hive","authentication","delegation-token","parsing"],"backgroundTag":"invalid-delegation-token","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}