{"record":{"id":"7b9de9e71a86b8fd","repo":"apache/hadoop","slug":"s-did-not-respond-with-json-to-the-s-delegat","errorCode":null,"errorMessage":"'%s' did not respond with JSON to the '%s' delegation token operation","messagePattern":"'(.+?)' did not respond with JSON to the '(.+?)' delegation token operation","errorType":"exception","errorClass":"AuthenticationException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/web/DelegationTokenAuthenticator.java","lineNumber":342,"sourceCode":"    try {\n      conn = aUrl.openConnection(url, token);\n      conn.setRequestMethod(operation.getHttpMethod());\n      HttpExceptionUtils.validateResponse(conn, HttpURLConnection.HTTP_OK);\n      if (hasResponse) {\n        String contentType = conn.getHeaderField(CONTENT_TYPE);\n        contentType =\n            (contentType != null) ? StringUtils.toLowerCase(contentType) : null;\n        if (contentType != null &&\n            contentType.contains(APPLICATION_JSON_MIME)) {\n          try {\n            ret = JsonSerialization.mapReader().readValue(conn.getInputStream());\n          } catch (Exception ex) {\n            throw new AuthenticationException(String.format(\n                \"'%s' did not handle the '%s' delegation token operation: %s\",\n                url.getAuthority(), operation, ex.getMessage()), ex);\n          }\n        } else {\n          throw new AuthenticationException(String.format(\"'%s' did not \" +\n                  \"respond with JSON to the '%s' delegation token operation\",\n              url.getAuthority(), operation));\n        }\n      }\n    } finally {\n      if (dt != null) {\n        ((DelegationTokenAuthenticatedURL.Token) token).setDelegationToken(dt);\n      }\n      if (conn != null) {\n        conn.disconnect();\n      }\n    }\n    return ret;\n  }\n\n}\n","sourceCodeStart":324,"sourceCodeEnd":359,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/web/DelegationTokenAuthenticator.java#L324-L359","documentation":"Client-side guard in doDelegationTokenOperation: for ops with a response, the Content-Type header must exist and contain application/json. When it does not, the client throws AuthenticationException \"'<authority>' did not respond with JSON to the '<op>' delegation token operation\" - the endpoint answered, but whatever came back (usually an HTML login/404/error page) is not a delegation-token API response.","triggerScenarios":"GETDELEGATIONTOKEN/RENEW sent to a URL not fronted by DelegationTokenAuthenticationFilter (plain HTTP server, wrong port, 404 static page), an auth redirect (302 to an HTML login form) from an SSO/gateway, or a text/plain servlet error.","commonSituations":"Wrong port or path (e.g. NameNode RPC/web port instead of the token-aware web endpoint, HttpFS 14000 vs WebHDFS 1022/9870); Knox/gateway SSO intercepting unauthenticated requests; HTTP->HTTPS redirect losing the op.","solutions":["curl -i the exact URL and confirm it serves application/json for the op; fix the URL/port to the token-aware web endpoint.","Authenticate up front (SPNEGO/token) so gateways do not redirect to HTML login pages.","Fix gateway/proxy routing to pass delegation-token operations through to Hadoop untouched.","Verify the op name is spelled GETDELEGATIONTOKEN/RENEWDELEGATIONTOKEN so the filter handles it."],"exampleFix":"# before: hitting a non-token endpoint -> Content-Type: text/html\nurl = new URL(\"http://nn:9870/\")\n# after: use the endpoint fronted by DelegationTokenAuthenticationFilter\nurl = new URL(\"http://nn:1022/webhdfs/v1/?op=GETDELEGATIONTOKEN&renewer=hdfs\")","handlingStrategy":"try-catch","validationCode":"// Validate the URL targets a token-aware endpoint before calling the API\nHttpURLConnection c = (HttpURLConnection) url.openConnection();\nString ct = c.getHeaderField(\"Content-Type\");\nboolean json = ct != null && ct.toLowerCase().contains(\"application/json\");\nif (!json) throw new IOException(\"Not a delegation-token endpoint: \" + url);","typeGuard":null,"tryCatchPattern":"catch (AuthenticationException e) {\n  if (e.getMessage().contains(\"did not respond with JSON\")) {\n    // wrong endpoint or gateway redirect: fix URL/port or authenticate first, then retry\n  }\n}","preventionTips":["Keep a documented map of which port/path serves token ops for each service (WebHDFS vs HttpFS vs KMS).","Authenticate before token ops so SSO gateways do not redirect to HTML login pages.","Assert application/json on token endpoints in integration tests."],"tags":["client","content-type","delegation-token","http","proxy"],"backgroundTag":"http-wrong-content-type","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}