{"record":{"id":"8babd294629cf7a2","repo":"apache/hadoop","slug":"no-delegation-token-found-for-this-identifier","errorCode":null,"errorMessage":"No delegation token found for this identifier","messagePattern":"No delegation token found for this identifier","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/security/token/delegation/DelegationTokenSecretManager.java","lineNumber":160,"sourceCode":"        throw it;\n      }\n    }\n  }\n  \n  /**\n   * Returns expiry time of a token given its identifier.\n   * \n   * @param dtId DelegationTokenIdentifier of a token\n   * @return Expiry time of the token\n   * @throws IOException\n   */\n  public synchronized long getTokenExpiryTime(\n      DelegationTokenIdentifier dtId) throws IOException {\n    DelegationTokenInformation info = currentTokens.get(dtId);\n    if (info != null) {\n      return info.getRenewDate();\n    } else {\n      throw new IOException(\"No delegation token found for this identifier\");\n    }\n  }\n\n  /**\n   * Load SecretManager state from fsimage.\n   * \n   * @param in input stream to read fsimage\n   * @throws IOException\n   */\n  public synchronized void loadSecretManagerStateCompat(DataInput in)\n      throws IOException {\n    if (running) {\n      // a safety check\n      throw new IOException(\n          \"Can't load state from image in a running SecretManager.\");\n    }\n    serializerCompat.load(in);\n  }","sourceCodeStart":142,"sourceCodeEnd":178,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/security/token/delegation/DelegationTokenSecretManager.java#L142-L178","documentation":"DelegationTokenSecretManager.getTokenExpiryTime throws IOException when asked for the expiry of a DelegationTokenIdentifier that is not in currentTokens. Tokens live in currentTokens only while valid: the expired-token reaper removes them after maxLifetime, cancellation removes them immediately, and a restarted/reloaded secret manager only knows tokens persisted in fsimage. A miss therefore means expired, canceled, unknown-to-this-NN, or state not yet loaded.","triggerScenarios":"getTokenExpiryTime(dtId) is called for an identifier that was never added or was removed — renewing/canceling after expiry, querying a token issued by the other HA NameNode before state propagated, or checking a token against a fresh NN that has not loaded the checkpoint containing it.","commonSituations":"Client lets a delegation token expire (default 7d max lifetime) then attempts renew; token canceled by another client; HA failover where the new Active's token state differs; Spark/Hive/oozie long-lived jobs holding tokens across expiry; tools inspecting token expiry against the wrong NameNode.","solutions":["Have the client catch the IOException and treat it as 'token invalid': obtain a new delegation token (re-login with kerberos and request via WebHDFS/HDFS RPC getDelegationToken) and retry.","For schedulers of long jobs, renew well before dfs.delegation.token.max-lifetime and re-fetch before renew window closes; never cache tokens beyond max lifetime.","In HA setups confirm both NameNodes (shared edits) have the token; query the Active that issued/last renewed it.","If you expected the token to still be valid, check the canceler in NN audit logs and the token lifetime configuration (dfs.delegation.token.renew-interval / max-lifetime)."],"exampleFix":"// before\nlong expiry = dtSecretManager.getTokenExpiryTime(identifier); // IOException: No delegation token found\n\n// after\nlong expiry;\ntry {\n  expiry = dtSecretManager.getTokenExpiryTime(identifier);\n} catch (IOException e) {\n  // token unknown/expired/canceled -> fetch a fresh one\n  Token<DelegationTokenIdentifier> t = getNewDelegationToken(nn, user);\n  expiry = dtSecretManager.getTokenExpiryTime(t.decodeIdentifier());\n}","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  long expiry = dtSecretManager.getTokenExpiryTime(identifier);\n} catch (IOException e) {\n  if (\"No delegation token found for this identifier\".equals(e.getMessage())) {\n    // token expired/canceled/unknown: reacquire a delegation token and retry\n    token = fetchNewDelegationToken();\n  } else { throw e; }\n}","preventionTips":["Renew delegation tokens well before dfs.delegation.token.max-lifetime.","Schedule re-fetch (not just renew) for jobs longer than max lifetime.","Audit token cancellations in NN audit logs when tokens vanish unexpectedly."],"tags":["hdfs","delegation-token","security","auth","expiry"],"backgroundTag":"token-not-found","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}