{"record":{"id":"66ff8d1d3e6d0194","repo":"apache/hadoop","slug":"delegation-token-can-be-issued-only-with-kerberos","errorCode":null,"errorMessage":"Delegation Token can be issued only with kerberos or web authentication","messagePattern":"Delegation Token can be issued only with kerberos or web authentication","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/FSNamesystem.java","lineNumber":6440,"sourceCode":"  }\n\n  /**\n   * @param renewer Renewer information\n   * @return delegation toek\n   * @throws IOException on error\n   */\n  Token<DelegationTokenIdentifier> getDelegationToken(Text renewer)\n      throws IOException {\n    final String operationName = \"getDelegationToken\";\n    String tokenId = null;\n    Token<DelegationTokenIdentifier> token;\n    checkOperation(OperationCategory.WRITE);\n    writeLock(RwLockMode.FS);\n    try {\n      checkOperation(OperationCategory.WRITE);\n      checkNameNodeSafeMode(\"Cannot issue delegation token\");\n      if (!isAllowedDelegationTokenOp()) {\n        throw new IOException(\n          \"Delegation Token can be issued only with kerberos or web authentication\");\n      }\n      if (dtSecretManager == null || !dtSecretManager.isRunning()) {\n        LOG.warn(\"trying to get DT with no secret manager running\");\n        return null;\n      }\n\n      UserGroupInformation ugi = getRemoteUser();\n      String user = ugi.getUserName();\n      Text owner = new Text(user);\n      Text realUser = null;\n      if (ugi.getRealUser() != null) {\n        realUser = new Text(ugi.getRealUser().getUserName());\n      }\n      DelegationTokenIdentifier dtId = new DelegationTokenIdentifier(owner,\n        renewer, realUser);\n      token = new Token<DelegationTokenIdentifier>(\n        dtId, dtSecretManager);","sourceCodeStart":6422,"sourceCodeEnd":6458,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/FSNamesystem.java#L6422-L6458","documentation":"Error \"Delegation Token can be issued only with kerberos or web authentication\" thrown in apache/hadoop.","triggerScenarios":"A client calls getDelegationToken over an unauthenticated (simple auth or no auth) connection.","commonSituations":"Requesting delegation tokens from a cluster configured with simple authentication instead of Kerberos.","solutions":["Enable Kerberos authentication (hadoop.security.authentication=kerberos) or web authentication before requesting a delegation token."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}