{"record":{"id":"48f7128f65b06340","repo":"apache/hadoop","slug":"undefined-property-signature-secret-file","errorCode":null,"errorMessage":"Undefined property: signature.secret.file","messagePattern":"Undefined property: signature\\.secret\\.file","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"critical","filePath":"hadoop-hdfs-project/hadoop-hdfs-httpfs/src/main/java/org/apache/hadoop/fs/http/server/HttpFSAuthenticationFilter.java","lineNumber":81,"sourceCode":"   * <code>hadoop.http.authentication</code>. The\n   * <code>hadoop.http.authentication</code> prefix is removed from the\n   * returned property names.\n   *\n   * @param configPrefix parameter not used.\n   * @param filterConfig parameter not used.\n   *\n   * @return hadoop-auth configuration read from HttpFSServer's configuration.\n   */\n  @Override\n  protected Properties getConfiguration(String configPrefix,\n      FilterConfig filterConfig) throws ServletException{\n    Configuration conf = HttpFSServerWebApp.get().getConfig();\n    Properties props = HttpServer2.getFilterProperties(conf,\n        new ArrayList<>(Arrays.asList(CONF_PREFIXES)));\n\n    String signatureSecretFile = props.getProperty(SIGNATURE_SECRET_FILE, null);\n    if (signatureSecretFile == null) {\n      throw new RuntimeException(\"Undefined property: \"\n          + SIGNATURE_SECRET_FILE);\n    }\n\n    if (!isRandomSecret(filterConfig)) {\n      try (Reader reader = new InputStreamReader(Files.newInputStream(\n          Paths.get(signatureSecretFile)), StandardCharsets.UTF_8)) {\n        StringBuilder secret = new StringBuilder();\n        int c = reader.read();\n        while (c > -1) {\n          secret.append((char) c);\n          c = reader.read();\n        }\n\n        String secretString = secret.toString();\n        if (secretString.isEmpty()) {\n          throw new RuntimeException(\n              \"No secret in HttpFs signature secret file: \"\n                  + signatureSecretFile);","sourceCodeStart":63,"sourceCodeEnd":99,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-hdfs-project/hadoop-hdfs-httpfs/src/main/java/org/apache/hadoop/fs/http/server/HttpFSAuthenticationFilter.java#L63-L99","documentation":"When HttpFS runs with hadoop-auth authentication enabled, HttpFSAuthenticationFilter.getConfiguration() must find a signature secret (used to sign auth cookies). Unless random-secret mode is active, it requires the property signature.secret.file (exposed as httpfs.authentication.signature.secret.file); if it is absent from the effective configuration, filter initialization throws RuntimeException('Undefined property: signature.secret.file') and the HttpFS webapp fails to deploy.","triggerScenarios":"Changing httpfs.authentication.type from simple to kerberos/form without also setting httpfs.authentication.signature.secret.file; deploying a new HttpFS node from a template that omits the auth keys; running with a prefix the filter does not read (only httpfs.authentication.* and hadoop.http.* prefixed keys are picked up).","commonSituations":"Enabling Kerberos or anonymous+simple auth on a cluster where HttpFS was previously running type=simple; config keys misspelled or placed in the wrong file; expecting a default secret file location that does not exist.","solutions":["Set httpfs.authentication.signature.secret.file in httpfs-site.xml to the absolute path of a file containing a random secret (e.g. generated with openssl rand -base64 32), readable by the httpfs user.","Ensure the file exists, is non-empty, and has tight permissions (owner httpfs, mode 400/640) — otherwise you hit the follow-on errors 3643/3644.","Alternatively configure a random secret per the hadoop-auth random-secret mechanism (signature.secret.file init-param handled by isRandomSecret) if a per-instance secret is acceptable.","If you did not intend to run authenticated, revert httpfs.authentication.type to simple."],"exampleFix":"<!-- before: httpfs-site.xml -->\n<property><name>httpfs.authentication.type</name><value>kerberos</value></property>\n\n<!-- after -->\n<property><name>httpfs.authentication.type</name><value>kerberos</value></property>\n<property><name>httpfs.authentication.signature.secret.file</name><value>/etc/hadoop/security/httpfs-signature-secret</value></property>","handlingStrategy":"validation","validationCode":"# pre-start check\nCONF=$(find /etc/hadoop -name httpfs-site.xml)\ngrep -q 'httpfs.authentication.signature.secret.file' \"$CONF\" || {\n  echo 'FATAL: signature.secret.file not configured'; exit 1; }\ngrep -A1 'httpfs.authentication.type' \"$CONF\" | grep -qv simple || exit 0  # simple needs no secret","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Template auth config as a unit: type, signature.secret.file, kerberos params together.","Automate secret generation and distribution (openssl rand) so the property is never merely declared.","Include a config lint step in CI for httpfs-site.xml before deployment."],"tags":["httpfs","hadoop-auth","authentication","configuration","startup-failure","signature-secret"],"backgroundTag":"missing-auth-config","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}