{"record":{"id":"88779002fe1a182f","repo":"apache/hadoop","slug":"protocol-is-not-known","errorCode":null,"errorMessage":"Protocol {} is not known.","messagePattern":"Protocol (.+?) is not known\\.","errorType":"exception","errorClass":"AuthorizationException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/authorize/ServiceAuthorizationManager.java","lineNumber":96,"sourceCode":"  \n  /**\n   * Authorize the user to access the protocol being used.\n   * \n   * @param user user accessing the service \n   * @param protocol service being accessed\n   * @param conf configuration to use\n   * @param addr InetAddress of the client\n   * @throws AuthorizationException on authorization failure\n   */\n  public void authorize(UserGroupInformation user, \n                               Class<?> protocol,\n                               Configuration conf,\n                               InetAddress addr\n                               ) throws AuthorizationException {\n    AccessControlList[] acls = protocolToAcls.get(protocol);\n    MachineList[] hosts = protocolToMachineLists.get(protocol);\n    if (acls == null || hosts == null) {\n      throw new AuthorizationException(\"Protocol \" + protocol + \n                                       \" is not known.\");\n    }\n\n    String clientPrincipal = null;\n    if (UserGroupInformation.isSecurityEnabled()) {\n      // get client principal key to verify (if available)\n      clientPrincipal = SecurityUtil.getClientPrincipal(protocol, conf);\n      try {\n        if (clientPrincipal != null) {\n          clientPrincipal =\n              SecurityUtil.getServerPrincipal(clientPrincipal, addr);\n        }\n      } catch (IOException e) {\n        throw (AuthorizationException) new AuthorizationException(\n            \"Can't figure out Kerberos principal name for connection from \"\n                + addr + \" for user=\" + user + \" protocol=\" + protocol)\n            .initCause(e);\n      }","sourceCodeStart":78,"sourceCodeEnd":114,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/authorize/ServiceAuthorizationManager.java#L78-L114","documentation":"ServiceAuthorizationManager.authorize throws AuthorizationException when the protocol has no entry in protocolToAcls/protocolToMachineLists — meaning no ACL (and host ACL) was registered for that protocol when the policy was loaded from hadoop-policy.xml via the PolicyProvider. With hadoop.security.authorization=true every protocol needs a security.<protocol>.acl entry.","triggerScenarios":"Hadoop RPC with service-level authorization enabled where the protocol (e.g. a custom protocol, or org.apache.hadoop.hdfs.protocol.ClientProtocol) has no security.<name>.acl in hadoop-policy.xml; a custom PolicyProvider that does not cover the protocol; calling authorize() for a protocol after a refresh that dropped its entry.","commonSituations":"Turning on hadoop.security.authorization without completing hadoop-policy.xml; upgrading Hadoop and hitting a newly introduced protocol; third-party services registering custom RPC protocols without policy entries.","solutions":["Add security.<protocol-key>.acl (and security.<protocol-key>.hosts if needed) to hadoop-policy.xml, e.g. security.client.protocol.acl=*","Confirm hadoop.policy.file points to your policy file (System property, default hadoop-policy.xml) and it is on the classpath","For custom protocols, extend the PolicyProvider so refresh() registers ACLs for them","Refresh the running services with `dfsadmin -refreshServiceAcl` / `rmadmin -refreshServiceAcl`, or restart them"],"exampleFix":"<!-- hadoop-policy.xml: before -->\n<!-- no entry for the protocol -> 'Protocol X is not known' -->\n\n<!-- after -->\n<property>\n  <name>security.client.protocol.acl</name>\n  <value>*</value>\n</property>","handlingStrategy":"try-catch","validationCode":"boolean serviceAuthzEnabled = conf.getBoolean(\n    CommonConfigurationKeysPublic.HADOOP_SECURITY_AUTHORIZATION, false);\nif (serviceAuthzEnabled && customProtocol != null) {\n  // ensure hadoop-policy.xml has security.<protocol>.acl before enabling\n  Preconditions.checkState(policyCovers(customProtocol),\n      \"No service ACL for \" + customProtocol.getName());\n}","typeGuard":null,"tryCatchPattern":"try {\n  ServiceAuthorizationManager.authorize(user, protocol, conf, addr);\n} catch (AuthorizationException e) {\n  if (e.getMessage().contains(\"is not known\")) {\n    // policy registration problem: fix hadoop-policy.xml / PolicyProvider, not an access issue\n  }\n  throw e;\n}","preventionTips":["When enabling hadoop.security.authorization, audit hadoop-policy.xml for every protocol the cluster serves","Extend PolicyProvider for custom RPC protocols and add matching ACL entries","After upgrades, diff protocol lists against policy entries before re-enabling authorization"],"tags":["authorization","rpc","service-acl","hadoop-policy","hadoop","security"],"backgroundTag":"protocol-not-registered","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}