{"record":{"id":"83b4d0a0677acf1f","repo":"apache/hadoop","slug":"aws-authentication-chain-is-no-longer-supplying-se","errorCode":null,"errorMessage":"AWS Authentication chain is no longer supplying session secrets","messagePattern":"AWS Authentication chain is no longer supplying session secrets","errorType":"exception","errorClass":"DelegationTokenIOException","httpStatus":null,"severity":"error","filePath":"hadoop-tools/hadoop-aws/src/main/java/org/apache/hadoop/fs/s3a/auth/delegation/SessionTokenBinding.java","lineNumber":382,"sourceCode":"      // this is the normal route: ask for a new STS token\n      marshalledCredentials = fromSTSCredentials(\n          client.get()\n              .requestSessionCredentials(duration, TimeUnit.SECONDS));\n    } else {\n      // get a new set of parental session credentials (pick up IAM refresh)\n      if (!forwardMessageLogged.getAndSet(true)) {\n        // warn caller on the first -and only the first- use.\n        LOG.warn(\"Forwarding existing session credentials to {}\"\n            + \" -duration unknown\", getCanonicalUri());\n      }\n      origin += \" \" + CREDENTIALS_CONVERTED_TO_DELEGATION_TOKEN;\n      final AwsCredentials awsCredentials\n          = getParentAuthChain().resolveCredentials();\n      if (awsCredentials instanceof AwsSessionCredentials) {\n        marshalledCredentials = fromAWSCredentials(\n            (AwsSessionCredentials) awsCredentials);\n      } else {\n        throw new DelegationTokenIOException(\n            \"AWS Authentication chain is no longer supplying session secrets\");\n      }\n    }\n    return new SessionTokenIdentifier(getKind(),\n         getOwnerText(),\n         renewer,\n         getCanonicalUri(),\n         marshalledCredentials,\n         encryptionSecrets,\n         origin);\n  }\n\n  @Override\n  public SessionTokenIdentifier createEmptyIdentifier() {\n    return new SessionTokenIdentifier();\n  }\n\n  /**","sourceCodeStart":364,"sourceCodeEnd":400,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-tools/hadoop-aws/src/main/java/org/apache/hadoop/fs/s3a/auth/delegation/SessionTokenBinding.java#L364-L400","documentation":"SessionTokenBinding issues delegation tokens by marshalling the parent authentication chain's currently resolved credentials, and it requires those to be AwsSessionCredentials (access key + secret + session token). If the chain now resolves to non-session credentials, binding throws DelegationTokenIOException 'AWS Authentication chain is no longer supplying session secrets', refusing to mint a session-token identifier from credentials that carry no session component.","triggerScenarios":"SessionTokenBinding.createTokenIdentifier calls getParentAuthChain().resolveCredentials() and the result is not an instanceof AwsSessionCredentials. Happens when an STS/assumed-role session expired or provider order changed so a static-key or instance-profile provider now wins at token creation or renewal time.","commonSituations":"STS temporary credentials expiring mid-job right when a delegation token is requested; adding fs.s3a.aws.credentials.provider entries that put SimpleAWSCredentialsProvider ahead of session sources; switching from role-based to static keys without changing the binding away from SessionTokenBinding.","solutions":["Ensure the provider chain resolves to session credentials before token creation: use STS assume-role / web-identity / instance-profile providers and remove or reorder static-key providers that shadow them","Refresh the expired STS session (re-assume the role) and retry","If the deployment now uses long-lived keys, switch fs.s3a.delegation.token.binding to S3ATokenBinding instead of SessionTokenBinding"],"exampleFix":"<!-- before: static provider wins, chain returns AwsBasicCredentials -->\n<property><name>fs.s3a.aws.credentials.provider</name>\n  <value>org.apache.hadoop.fs.s3a.auth.SimpleAWSCredentialsProvider</value></property>\n\n<!-- after: session-capable provider first for SessionTokenBinding -->\n<property><name>fs.s3a.aws.credentials.provider</name>\n  <value>com.amazonaws.auth.STSAssumeRoleSessionCredentialsProvider</value></property>","handlingStrategy":"type-guard","validationCode":"AwsCredentials c = fs.getDelegationTokens() // or your auth chain\n    .getParentAuthChain().resolveCredentials();\nif (!(c instanceof AwsSessionCredentials)) {\n  throw new IOException(\"Session DT requested but chain supplies \"\n      + c.getClass().getSimpleName() + \" without session secrets\");\n}","typeGuard":"static boolean hasSessionSecrets(AwsCredentials c) {\n  return c instanceof AwsSessionCredentials\n      && ((AwsSessionCredentials) c).sessionToken() != null\n      && !((AwsSessionCredentials) c).sessionToken().isEmpty();\n}","tryCatchPattern":"try {\n  Token<AbstractS3ATokenIdentifier> dt = fs.getDelegationToken(renewer);\n} catch (DelegationTokenIOException e) {\n  if (e.getMessage().contains(\"no longer supplying session secrets\")) {\n    // STS session expired or provider order changed: refresh creds, then retry once\n    refreshStsSession();\n    dt = fs.getDelegationToken(renewer);\n  } else {\n    throw e;\n  }\n}","preventionTips":["Order providers so session-capable sources (STS/instance profile) win when SessionTokenBinding is used","Refresh STS sessions on a schedule well inside their lifetime","If moving to long-lived keys, switch the binding to S3ATokenBinding"],"tags":["aws","s3a","delegation-token","session-credentials","sts"],"backgroundTag":"missing-session-credentials","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}