{"record":{"id":"58a745e474f816c3","repo":"juicedata/juicefs","slug":"renew-token-failed","errorCode":null,"errorMessage":"renew token failed","messagePattern":"renew token failed","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"sdk/java/src/main/java/io/juicefs/kerberos/JuiceFSTokenRenewer.java","lineNumber":49,"sourceCode":"\n  @Override\n  public boolean handleKind(Text kind) {\n    return JuiceFSDelegationTokenIdentifier.TOKEN_KIND.equals(kind);\n  }\n\n  @Override\n  public boolean isManaged(Token<?> token) throws IOException {\n    return true;\n  }\n\n  @Override\n  public long renew(Token<?> token, Configuration configuration) throws IOException, InterruptedException {\n    String service = token.getService().toString();\n    FileSystem fs = FileSystem.get(URI.create(service), configuration);\n    if (fs instanceof JuiceFileSystem) {\n      return ((JuiceFileSystemImpl) ((FilterFileSystem) fs).getRawFileSystem()).renewToken(token);\n    }\n    throw new IOException(\"renew token failed\");\n  }\n\n  @Override\n  public void cancel(Token<?> token, Configuration configuration) throws IOException, InterruptedException {\n    String service = token.getService().toString();\n    FileSystem fs = FileSystem.get(URI.create(service), configuration);\n    if (fs instanceof JuiceFileSystem) {\n      ((JuiceFileSystemImpl) ((FilterFileSystem) fs).getRawFileSystem()).cancelToken(token);\n      return;\n    }\n    throw new IOException(\"cancel token failed\");\n  }\n}\n","sourceCodeStart":31,"sourceCodeEnd":63,"githubUrl":"https://github.com/juicedata/juicefs/blob/c9a67b23e8e08ec23ec331aa6f1675e2319e921c/sdk/java/src/main/java/io/juicefs/kerberos/JuiceFSTokenRenewer.java#L31-L63","documentation":"JuiceFSTokenRenewer.renew throws this IOException when the FileSystem obtained for the token's service URI is not a JuiceFileSystem (FilterFileSystem wrapping JuiceFileSystemImpl). Only JuiceFS tokens can be renewed by this renewer; anything else is rejected.","triggerScenarios":"Hadoop's DelegationTokenRenewer (testToken path) calls renew(token, conf); token.getService() resolves to a non-JuiceFS filesystem, or FileSystem.get returns an unwrapped/different fs instance (e.g. service URI scheme not juicefs or no FilterFileSystem wrapper).","commonSituations":"Token renewal thread picking up a foreign token with a renewer name that maps to JuiceFSTokenRenewer; service URI misconfiguration; filesystem not initialized as JuiceFileSystem in the cluster config; running renewer on a node where fs.impl mappings differ.","solutions":["Verify the token's service URI uses the juicefs scheme and fs.juicefs.impl maps to JuiceFileSystem","Ensure the renewer name on the token matches the JuiceFS renewer only for JuiceFS-issued tokens","Check that FileSystem.get returns a FilterFileSystem wrapping JuiceFileSystemImpl (as configured in core-site.xml)","Renew the token directly on the JuiceFS client instead of via the generic Hadoop renewer"],"exampleFix":"// before\nFileSystem fs = FileSystem.get(URI.create(service), configuration);\n((JuiceFileSystemImpl) ((FilterFileSystem) fs).getRawFileSystem()).renewToken(token);\n// after\nFileSystem fs = FileSystem.get(URI.create(service), configuration);\nif (!(fs instanceof JuiceFileSystem)) {\n  LOG.warn(\"Cannot renew token for non-JuiceFS filesystem: \" + service);\n  return;\n}","handlingStrategy":"try-catch","validationCode":"FileSystem fs = FileSystem.get(URI.create(token.getService().toString()), conf);\nboolean canRenew = fs instanceof JuiceFileSystem;","typeGuard":"boolean isJuiceFsToken(Token<?> t, Configuration c) {\n  try { return FileSystem.get(URI.create(t.getService().toString()), c) instanceof JuiceFileSystem; }\n  catch (Exception e) { return false; }\n}","tryCatchPattern":"try {\n  renewer.renew(token, conf);\n} catch (IOException e) {\n  if (\"renew token failed\".equals(e.getMessage())) {\n    LOG.warn(\"Token is not a JuiceFS token; skip renewal\", e);\n  } else throw e;\n}","preventionTips":["Only assign JuiceFSTokenRenewer as renewer for JuiceFS tokens","Keep fs.juicefs.impl consistent across the cluster","Test token renewal after any Hadoop config change"],"tags":["hadoop","kerberos","token","filesystem"],"backgroundTag":"unsupported-operation","analyzedSha":"c9a67b23e8e08ec23ec331aa6f1675e2319e921c","analyzedAt":"2026-09-06T17:55:48.476Z","contentChangedAt":"2026-09-06T17:55:48.476Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}