{"record":{"id":"6fd59c88f2f73a73","repo":"apache/hadoop","slug":"renewer-tries-to-renew-a-token-formattokenid-id","errorCode":null,"errorMessage":"{renewer} tries to renew a token {formatTokenId(id)} with non-matching renewer {id.getRenewer()}","messagePattern":"(.+?) tries to renew a token (.+?) with non-matching renewer (.+?)","errorType":"exception","errorClass":"AccessControlException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/AbstractDelegationTokenSecretManager.java","lineNumber":699,"sourceCode":"      ByteArrayInputStream buf = new ByteArrayInputStream(token.getIdentifier());\n      DataInputStream in = new DataInputStream(buf);\n      TokenIdent id = createIdentifier();\n      id.readFields(in);\n      LOG.info(\"Token renewal for identifier: \" + formatTokenId(id) + \"; total currentTokens \"\n          + currentTokens.size());\n\n      long now = Time.now();\n      if (id.getMaxDate() < now) {\n        throw new InvalidToken(renewer + \" tried to renew an expired token \" + formatTokenId(id) +\n            \" max expiration date: \" + Time.formatTime(id.getMaxDate()) + \" currentTime: \" +\n            Time.formatTime(now));\n      }\n      if ((id.getRenewer() == null) || (id.getRenewer().toString().isEmpty())) {\n        throw new AccessControlException(renewer + \" tried to renew a token \" + formatTokenId(id) +\n            \" without a renewer\");\n      }\n      if (!id.getRenewer().toString().equals(renewer)) {\n        throw new AccessControlException(renewer + \" tries to renew a token \" + formatTokenId(id) +\n            \" with non-matching renewer \" + id.getRenewer());\n      }\n      DelegationKey key = getDelegationKey(id.getMasterKeyId());\n      if (key == null) {\n        throw new InvalidToken(\"Unable to find master key for keyId=\" + id.getMasterKeyId() +\n            \" from cache. Failed to renew an unexpired token \" + formatTokenId(id) +\n            \" with sequenceNumber=\" + id.getSequenceNumber());\n      }\n      byte[] password = createPassword(token.getIdentifier(), key.getKey());\n      if (!MessageDigest.isEqual(password, token.getPassword())) {\n        throw new AccessControlException(\n            renewer + \" is trying to renew a token \" + formatTokenId(id) + \" with wrong password\");\n      }\n      long renewTime = Math.min(id.getMaxDate(), now + tokenRenewInterval);\n      String trackingId = getTrackingIdIfEnabled(id);\n      DelegationTokenInformation info =\n          new DelegationTokenInformation(renewTime, password, trackingId);\n","sourceCodeStart":681,"sourceCodeEnd":717,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/AbstractDelegationTokenSecretManager.java#L681-L717","documentation":"Error \"{renewer} tries to renew a token {formatTokenId(id)} with non-matching renewer {id.getRenewer()}\" thrown in apache/hadoop.","triggerScenarios":"Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/AbstractDelegationTokenSecretManager.java:699 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Only the renewer recorded in the token ({id.getRenewer()}) may renew it. Renew using that principal's credentials, or re-issue the token with '{renewer}' as the renewer."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}