{"record":{"id":"484cdb6e3fbedad7","repo":"apache/hadoop","slug":"fetch-of-delegation-token-failed","errorCode":null,"errorMessage":"Fetch of delegation token failed","messagePattern":"Fetch of delegation token failed","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/HdfsDtFetcher.java","lineNumber":78,"sourceCode":"\n  /**\n   *  Returns Token object via FileSystem, null if bad argument.\n   *  @param conf - a Configuration object used with FileSystem.get()\n   *  @param creds - a Credentials object to which token(s) will be added\n   *  @param renewer  - the renewer to send with the token request\n   *  @param url  - the URL to which the request is sent\n   *  @return a Token, or null if fetch fails.\n   */\n  public Token<?> addDelegationTokens(Configuration conf, Credentials creds,\n                                  String renewer, String url) throws Exception {\n    if (!url.startsWith(getServiceName().toString())) {\n      url = getServiceName().toString() + \"://\" + url;\n    }\n    FileSystem fs = FileSystem.get(URI.create(url), conf);\n    Token<?> token = fs.getDelegationToken(renewer);\n    if (token == null) {\n      LOG.error(FETCH_FAILED);\n      throw new IOException(FETCH_FAILED);\n    }\n    creds.addToken(token.getService(), token);\n    return token;\n  }\n}\n","sourceCodeStart":60,"sourceCodeEnd":84,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/HdfsDtFetcher.java#L60-L84","documentation":"HdfsDtFetcher is the HDFS DtFetcher plugin behind `hdfs fetchdt` token retrieval: it opens a FileSystem from the URL and calls fs.getDelegationToken(renewer). If that returns null - the FileSystem issued no token - it logs FETCH_FAILED and throws IOException('Fetch of delegation token failed').","triggerScenarios":"Fetching a delegation token from a URI whose FileSystem does not hand one out: a cluster running without security (getDelegationToken returns null when not Kerberos-enabled), a non-hdfs scheme, or a URL pointing at the wrong service. The null check at HdfsDtFetcher.java:78 is the throw site.","commonSituations":"Running `hdfs fetchdt --webservice <url> <file>` against a simple-auth cluster; typos in the URL; pointing fetchdt at webhdfs/file URLs whose implementations return null tokens; Oozie/CRON jobs fetching tokens for clusters without Kerberos.","solutions":["Confirm the target cluster actually has security enabled (hadoop.security.authentication=kerberos) - without it no delegation token exists to fetch","Use a proper hdfs:// URL naming the HA nameservice or NameNode RPC address","Check for typos in the URL and that the FileSystem it resolves supports delegation tokens"],"exampleFix":"// before: cluster has no Kerberos, or URL is wrong\nhdfs fetchdt --webservice http://wronghost:9870 /tmp/token\n// after: security-enabled cluster, correct nameservice URL\nhdfs fetchdt --webservice http://nn1:9870 /tmp/token   // nn1 in a kerberos-secured cluster","handlingStrategy":"try-catch","validationCode":"import org.apache.hadoop.security.SecurityUtil;\n\nURI u = URI.create(url);\nif (!\"hdfs\".equals(u.getScheme())) {\n  throw new IllegalArgumentException(\"fetchdt expects an hdfs:// URL, got: \" + url);\n}\nif (!SecurityUtil.getAuthenticationMethod(conf).equals(\n    org.apache.hadoop.security.UserGroupInformation.AuthenticationMethod.KERBEROS)) {\n  // no security -> no delegation tokens exist; skip the fetch rather than fail\n  return;\n}","typeGuard":null,"tryCatchPattern":"try {\n  fetcher.addDelegationTokens(conf, creds, renewer, url);\n} catch (IOException e) {\n  if (e.getMessage().contains(\"Fetch of delegation token failed\")) {\n    // token was not issued: verify security is enabled and the URL scheme,\n    // then surface an actionable error to the operator\n  } else {\n    throw e;\n  }\n}","preventionTips":["Verify hadoop.security.authentication=kerberos on the target cluster before scripting fetchdt","Validate the URL scheme is hdfs (or an httpfs endpoint in a secured cluster) before calling","Log FETCH_FAILED occurrences with the URL - they almost always mean wrong target, not a transient fault"],"tags":["hdfs","security","delegation-token","kerberos","fetchdt","credentials"],"backgroundTag":"delegation-token-fetch-failed","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}