{"record":{"id":"5fd4a5a8175064b4","repo":"apache/hadoop","slug":"server-challenge-contains-no-token","errorCode":null,"errorMessage":"Server challenge contains no token","messagePattern":"Server challenge contains no token","errorType":"exception","errorClass":"SaslException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SaslRpcClient.java","lineNumber":492,"sourceCode":"   * if it's not done.  If the server is done, the challenge token is\n   * optional because not all mechanisms send a final token for the client to\n   * update its internal state.  The client must also be done after\n   * evaluating the optional token to ensure a malicious server doesn't\n   * prematurely end the negotiation with a phony success.\n   *  \n   * @param saslResponse - client response to challenge\n   * @param serverIsDone - server negotiation state\n   * @throws SaslException - any problems with negotiation\n   */\n  private byte[] saslEvaluateToken(RpcSaslProto saslResponse,\n      boolean serverIsDone) throws SaslException {\n    byte[] saslToken = null;\n    if (saslResponse.hasToken()) {\n      saslToken = saslResponse.getToken().toByteArray();\n      saslToken = saslClient.evaluateChallenge(saslToken);\n    } else if (!serverIsDone) {\n      // the server may only omit a token when it's done\n      throw new SaslException(\"Server challenge contains no token\");\n    }\n    if (serverIsDone) {\n      // server tried to report success before our client completed\n      if (!saslClient.isComplete()) {\n        throw new SaslException(\"Client is out of sync with server\");\n      }\n      // a client cannot generate a response to a success message\n      if (saslToken != null) {\n        throw new SaslException(\"Client generated spurious response\");        \n      }\n    }\n    return saslToken;\n  }\n\n  private RpcSaslProto.Builder createSaslReply(SaslState state,\n                                               byte[] responseToken) {\n    RpcSaslProto.Builder response = RpcSaslProto.newBuilder();\n    response.setState(state);","sourceCodeStart":474,"sourceCodeEnd":510,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SaslRpcClient.java#L474-L510","documentation":"Error \"Server challenge contains no token\" thrown in apache/hadoop.","triggerScenarios":"Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SaslRpcClient.java:492 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check the server for token issuance failures; the SASL challenge arrived without a token.","Verify the server's secret manager and authentication filter are functioning and not dropping the challenge payload.","Retry after renewing client credentials; persistent cases need server log inspection."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}