{"record":{"id":"35f00f833550e0bb","repo":"t8y2/dbx","slug":"token-identifier-and-password-must-be-non-empty","errorCode":null,"errorMessage":"token identifier and password must be non-empty","messagePattern":"token identifier and password must be non-empty","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/argo-go/config.go","lineNumber":784,"sourceCode":"\t\tdecoded, decodeErr = encoding.DecodeString(encoded)\n\t\tif decodeErr == nil {\n\t\t\tbreak\n\t\t}\n\t}\n\tif decodeErr != nil {\n\t\treturn nil, nil, decodeErr\n\t}\n\treader := strings.NewReader(string(decoded))\n\tidentifier, err := readHadoopByteArray(reader)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"identifier: %w\", err)\n\t}\n\tpassword, err := readHadoopByteArray(reader)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"password: %w\", err)\n\t}\n\tif len(identifier) == 0 || len(password) == 0 {\n\t\treturn nil, nil, errors.New(\"token identifier and password must be non-empty\")\n\t}\n\tif _, err := readHadoopByteArray(reader); err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"kind: %w\", err)\n\t}\n\tif _, err := readHadoopByteArray(reader); err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"service: %w\", err)\n\t}\n\tif reader.Len() != 0 {\n\t\treturn nil, nil, errors.New(\"token contains trailing data\")\n\t}\n\treturn identifier, password, nil\n}\n\nfunc readHadoopByteArray(reader io.ByteReader) ([]byte, error) {\n\tlength, err := readHadoopVInt(reader)\n\tif err != nil {\n\t\treturn nil, err\n\t}","sourceCodeStart":766,"sourceCodeEnd":802,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/argo-go/config.go#L766-L802","documentation":"After decoding the base64 delegation token, the driver reads the Hadoop token's fields (identifier, password, kind, service). If the decoded identifier or password byte slice is empty, the token is malformed, so decodeHadoopDelegationToken returns this error — the token decodes but does not contain a valid identifier/password pair.","triggerScenarios":"Passing a base64 string that decodes successfully but whose binary structure yields a zero-length identifier or password — e.g. a truncated token, a token from the wrong cluster/version, or arbitrary base64 data.","commonSituations":"Token copied partially (truncated at paste); token issued by an incompatible Hadoop version; confusion between JWT strings and Hadoop delegation tokens (a JWT is valid base64 but not a Hadoop token).","solutions":["Re-fetch a fresh, complete delegation token from the Hadoop/HistoryServer (e.g. via kinit + hdfs fetchdt or the Hive thrift GetDelegationToken call)","Verify you are passing a Hadoop delegation token, not a JWT or other base64 blob","Check that the token was not truncated (correct length, no shell-mangled characters)"],"exampleFix":"// before\nvalues[\"delegationToken\"] = jwtString // wrong token type\n// after\nvalues[\"delegationToken\"] = hadoopDelegationTokenBase64 // from GetDelegationToken","handlingStrategy":"validation","validationCode":"raw, err := base64.StdEncoding.DecodeString(token)\nif err != nil || len(raw) < 8 {\n    return errors.New(\"token too short to be a Hadoop delegation token\")\n}","typeGuard":null,"tryCatchPattern":"identifier, password, err := decodeHadoopDelegationToken(token)\nif err != nil {\n    if strings.Contains(err.Error(), \"must be non-empty\") { /* refetch token */ }\n    return err\n}","preventionTips":["Fetch tokens fresh from the cluster rather than copying long-lived copies","Confirm the token type (Hadoop delegation token vs JWT) before passing it","Guard against truncation when passing tokens through shell/scripts"],"tags":["go","hive","delegation-token","hadoop","malformed-token"],"backgroundTag":"malformed-auth-token","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}