{"record":{"id":"546c264375e40325","repo":"apache/hadoop","slug":"method-authentication-is-not-enabled-availabl","errorCode":null,"errorMessage":"${method} authentication is not enabled.  Available:${enabledAuthMethods}","messagePattern":"(.+?) authentication is not enabled\\.  Available:(.+?)","errorType":"exception","errorClass":"AccessControlException","httpStatus":null,"severity":"critical","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/ipc/Server.java","lineNumber":2422,"sourceCode":"                \"Client already attempted negotiation\");\n          }\n          saslResponse = buildSaslNegotiateResponse();\n          // simple-only server negotiate response is success which client\n          // interprets as switch to simple\n          if (saslResponse.getState() == SaslState.SUCCESS) {\n            switchToSimple();\n          }\n          break;\n        }\n        case INITIATE: {\n          if (saslMessage.getAuthsCount() != 1) {\n            throw new SaslException(\"Client mechanism is malformed\");\n          }\n          // verify the client requested an advertised authType\n          SaslAuth clientSaslAuth = saslMessage.getAuths(0);\n          if (!negotiateResponse.getAuthsList().contains(clientSaslAuth)) {\n            if (sentNegotiate) {\n              throw new AccessControlException(\n                  clientSaslAuth.getMethod() + \" authentication is not enabled.\"\n                      + \"  Available:\" + enabledAuthMethods);\n            }\n            saslResponse = buildSaslNegotiateResponse();\n            break;\n          }\n          authMethod = AuthMethod.valueOf(clientSaslAuth.getMethod());\n          // abort SASL for SIMPLE auth, server has already ensured that\n          // SIMPLE is a legit option above.  we will send no response\n          if (authMethod == AuthMethod.SIMPLE) {\n            switchToSimple();\n            saslResponse = null;\n            break;\n          }\n          // sasl server for tokens may already be instantiated\n          if (saslServer == null || authMethod != AuthMethod.TOKEN) {\n            saslServer = createSaslServer(authMethod);\n          }","sourceCodeStart":2404,"sourceCodeEnd":2440,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/ipc/Server.java#L2404-L2440","documentation":"After the server advertised its enabled auth methods, the client INITIATEd with one not on that list (and the server had already sent NEGOTIATE), so processSaslMessage rejects it with AccessControlException listing the enabled methods. The classic case is a client attempting KERBEROS or TOKEN against a server running SIMPLE-only authentication.","triggerScenarios":"Client with hadoop.security.authentication=kerberos talking to a server with simple; client selecting TOKEN when the server has no token secret manager / token auth disabled; any client picking a method absent from the server's 'Available:' list.","commonSituations":"Client core-site.xml not matching the cluster's security configuration; cross-cluster access (distcp, federation) between secure and insecure clusters; gateway machines with stale configs; clients defaulting to a stronger method than the server permits.","solutions":["Set hadoop.security.authentication to the same value (simple or kerberos) in the client's core-site.xml and the server's.","Pick an auth method from the 'Available:' list in the message and configure the client to use it.","For secure clusters, make sure the client loads the cluster's actual configuration files and performs kinit."],"exampleFix":"<!-- before: client attempts kerberos, server is simple -->\n<property><name>hadoop.security.authentication</name><value>kerberos</value></property>\n<!-- after: match the server -->\n<property><name>hadoop.security.authentication</name><value>simple</value></property>","handlingStrategy":"validation","validationCode":"String clientAuth = conf.get(\"hadoop.security.authentication\", \"simple\");\nString clusterAuth = clusterConf.get(\"hadoop.security.authentication\", \"simple\");\nif (!clientAuth.equals(clusterAuth)) {\n  throw new IllegalStateException(\"auth mismatch: client=\" + clientAuth\n      + \", cluster=\" + clusterAuth);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Ship the cluster's core-site.xml with clients instead of hand-written local configs.","Verify hadoop.security.authentication on both ends whenever wiring a new client or gateway.","For secure clusters, ensure kinit is done and the client uses Kerberos-enabled configuration."],"tags":["rpc","sasl","security","authentication","configuration","mismatch"],"backgroundTag":"authentication-mechanism-mismatch","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}