{"record":{"id":"6eedad7da6f47c2d","repo":"apache/hadoop","slug":"can-t-add-persisted-delegation-token-to-a-running","errorCode":null,"errorMessage":"Can't add persisted delegation token to a running SecretManager.","messagePattern":"Can't add persisted delegation token to a running SecretManager\\.","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/AbstractDelegationTokenSecretManager.java","lineNumber":459,"sourceCode":"    currentTokens.put(ident, tokenInfo);\n    updateStoredToken(ident, tokenInfo.getRenewDate());\n  }\n\n  /**\n   * This method is intended to be used for recovering persisted delegation\n   * tokens. Tokens that have an unknown <code>DelegationKey</code> are\n   * marked as expired and automatically cleaned up.\n   * This method must be called before this secret manager is activated (before\n   * startThreads() is called)\n   * @param identifier identifier read from persistent storage\n   * @param renewDate token renew time\n   * @throws IOException raised on errors performing I/O.\n   */\n  public void addPersistedDelegationToken(\n      TokenIdent identifier, long renewDate) throws IOException {\n    if (running) {\n      // a safety check\n      throw new IOException(\n          \"Can't add persisted delegation token to a running SecretManager.\");\n    }\n    this.apiLock.writeLock().lock();\n    try {\n      int keyId = identifier.getMasterKeyId();\n      DelegationKey dKey = allKeys.get(keyId);\n      byte[] password = null;\n      if (dKey == null) {\n        LOG.warn(\"No KEY found for persisted identifier, expiring stored token \" + formatTokenId(\n            identifier));\n        // make sure the token is expired\n        renewDate = 0L;\n      } else {\n        password = createPassword(identifier.getBytes(), dKey.getKey());\n      }\n      if (identifier.getSequenceNumber() > getDelegationTokenSeqNum()) {\n        setDelegationTokenSeqNum(identifier.getSequenceNumber());\n      }","sourceCodeStart":441,"sourceCodeEnd":477,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/AbstractDelegationTokenSecretManager.java#L441-L477","documentation":"Error \"Can't add persisted delegation token to a running SecretManager.\" thrown in apache/hadoop.","triggerScenarios":"Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/AbstractDelegationTokenSecretManager.java:459 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Load persisted tokens during recovery (loadFromStore) before the SecretManager starts its threads. Restart the service so stored tokens are loaded at startup instead of after it is running."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}