{"record":{"id":"444938db22ba67c4","repo":"apache/hadoop","slug":"canceller-is-not-authorized-to-cancel-the-token","errorCode":null,"errorMessage":"{canceller} is not authorized to cancel the token {formatTokenId(id)}","messagePattern":"(.+?) is not authorized to cancel the token (.+?)","errorType":"exception","errorClass":"AccessControlException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/AbstractDelegationTokenSecretManager.java","lineNumber":757,"sourceCode":"    this.apiLock.writeLock().lock();\n    try {\n      ByteArrayInputStream buf = new ByteArrayInputStream(token.getIdentifier());\n      DataInputStream in = new DataInputStream(buf);\n      TokenIdent id = createIdentifier();\n      id.readFields(in);\n      LOG.info(\"Token cancellation requested for identifier: \" + formatTokenId(id));\n\n      if (id.getUser() == null) {\n        throw new InvalidToken(\"Token with no owner \" + formatTokenId(id));\n      }\n      String owner = id.getUser().getUserName();\n      Text renewer = id.getRenewer();\n      HadoopKerberosName cancelerKrbName = new HadoopKerberosName(canceller);\n      String cancelerShortName = cancelerKrbName.getShortName();\n      if (!canceller.equals(owner) &&\n          (renewer == null || renewer.toString().isEmpty() ||\n              !cancelerShortName.equals(renewer.toString()))) {\n        throw new AccessControlException(canceller + \" is not authorized to cancel the token \" +\n            formatTokenId(id));\n      }\n      DelegationTokenInformation info = currentTokens.remove(id);\n      if (info == null) {\n        throw new InvalidToken(\"Token not found \" + formatTokenId(id));\n      }\n      METRICS.trackRemoveToken(() -> {\n        removeTokenForOwnerStats(id);\n        removeStoredToken(id);\n      });\n      return id;\n    } finally {\n      this.apiLock.writeLock().unlock();\n    }\n  }\n  \n  /**\n   * Convert the byte[] to a secret key","sourceCodeStart":739,"sourceCodeEnd":775,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/AbstractDelegationTokenSecretManager.java#L739-L775","documentation":"Error \"{canceller} is not authorized to cancel the token {formatTokenId(id)}\" thrown in apache/hadoop.","triggerScenarios":"Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/AbstractDelegationTokenSecretManager.java:757 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Only the token owner or the renewer may cancel token {formatTokenId(id)}. Cancel it as that principal (kinit as the owner/renewer) or have an administrator cancel it."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}