{"record":{"id":"86ea72eee703f217","repo":"apache/hadoop","slug":"unable-to-bind-on-specified-info-port-in-secure-co","errorCode":null,"errorMessage":"Unable to bind on specified info port in secure context. Needed {}, got {}","messagePattern":"Unable to bind on specified info port in secure context\\. Needed (.+?), got (.+?)","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"critical","filePath":"hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/datanode/SecureDataNodeStarter.java","lineNumber":168,"sourceCode":"    // Bind a port for the web server. The code intends to bind HTTP server to\n    // privileged port only, as the client can authenticate the server using\n    // certificates if they are communicating through SSL.\n    final ServerSocketChannel httpChannel;\n    if (policy.isHttpEnabled()) {\n      httpChannel = ServerSocketChannel.open();\n      InetSocketAddress infoSocAddr = DataNode.getInfoAddr(conf);\n      try {\n        httpChannel.socket().bind(infoSocAddr);\n      } catch (BindException e) {\n        BindException newBe = appendMessageToBindException(e,\n            infoSocAddr.toString());\n        throw newBe;\n      }\n      InetSocketAddress localAddr = (InetSocketAddress) httpChannel.socket()\n        .getLocalSocketAddress();\n\n      if (localAddr.getPort() != infoSocAddr.getPort()) {\n        throw new RuntimeException(\"Unable to bind on specified info port in \" +\n            \"secure context. Needed \" + infoSocAddr.getPort() + \", got \" +\n             ss.getLocalPort());\n      }\n      System.err.println(\"Successfully obtained privileged resources (streaming port = \"\n          + ss + \" ) (http listener port = \" + localAddr.getPort() +\")\");\n\n      isHttpPrivileged = SecurityUtil.isPrivilegedPort(localAddr.getPort());\n      System.err.println(\"Opened info server at \" + infoSocAddr);\n    } else {\n      httpChannel = null;\n    }\n\n    return new SecureResources(ss, httpChannel, isSaslEnabled,\n        isRpcPrivileged, isHttpPrivileged);\n  }\n\n  private static BindException appendMessageToBindException(BindException e,\n      String msg) {","sourceCodeStart":150,"sourceCodeEnd":186,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/datanode/SecureDataNodeStarter.java#L150-L186","documentation":"Secure (jsvc) startup binds the DataNode HTTP info server socket and verifies the bound port equals the configured dfs.datanode.http.address port. If they differ (in practice, the configured info port is 0 so an ephemeral port was assigned), it throws this RuntimeException: in secure context the HTTP(S) port must be fixed so clients can authenticate the server. Note the message has a known cosmetic bug - the 'got' value printed is ss.getLocalPort() (the streaming port), not the HTTP port actually bound.","triggerScenarios":"jsvc secure startup with HTTP policy enabled (dfs.http.policy HTTP_ONLY or HTTPS_ONLY) while dfs.datanode.http.address (or dfs.datanode.https.address per policy) has port 0; httpChannel.socket().bind() then takes an ephemeral port and localAddr.getPort() != infoSocAddr.getPort().","commonSituations":"Default/inherited config with dfs.datanode.http.address=0.0.0.0:0 (or :50475 for https left at 0 semantics) carried into a secure deployment; admins disabling the info port deliberately with port 0 but leaving HTTP policy enabled instead of switching policy off.","solutions":["Set a fixed info port: dfs.datanode.http.address=0.0.0.0:9864 (and/or dfs.datanode.https.address=0.0.0.0:9865 when dfs.http.policy is HTTPS_ONLY), restart under jsvc","If you do not want an HTTP server, set dfs.http.policy=HTTPS_ONLY and configure https.address with a concrete port rather than relying on port 0","Read the 'Needed' value in the message as the port to configure; ignore the misleading 'got' number (it echoes the streaming port due to the printing bug)"],"exampleFix":"# before (hdfs-site.xml)\n<property><name>dfs.datanode.http.address</name><value>0.0.0.0:0</value></property>\n\n# after\n<property><name>dfs.datanode.http.address</name><value>0.0.0.0:9864</value></property>","handlingStrategy":"validation","validationCode":"void assertFixedInfoPort(Configuration conf) {\n  String http = conf.get(\"dfs.datanode.http.address\", \"0.0.0.0:9864\");\n  String https = conf.get(\"dfs.datanode.https.address\", \"0.0.0.0:9865\");\n  for (String v : new String[]{http, https}) {\n    int port = Integer.parseInt(v.substring(v.lastIndexOf(':') + 1));\n    if (port == 0) throw new IllegalStateException(\n        \"Secure mode requires a fixed datanode info port: \" + v);\n  }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Set concrete ports for both dfs.datanode.http.address and dfs.datanode.https.address in secure deployments","If the HTTP server is unwanted, disable it via policy rather than port 0"],"tags":["hdfs","datanode","security","kerberos","jsvc","port-binding","http-server","startup"],"backgroundTag":"port-binding-failed","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}