{"record":{"id":"8f26b2bd3e9a57ea","repo":"apache/hadoop","slug":"webimageviewer-does-not-support-secure-mode-to-st","errorCode":null,"errorMessage":"WebImageViewer does not support secure mode. To start in non-secure mode, pass -Dhadoop.security.authentication=simple","messagePattern":"WebImageViewer does not support secure mode\\. To start in non-secure mode, pass -Dhadoop\\.security\\.authentication=simple","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/tools/offlineImageViewer/WebImageViewer.java","lineNumber":86,"sourceCode":"    this.workerGroup = new NioEventLoopGroup();\n    this.allChannels = new DefaultChannelGroup(GlobalEventExecutor.INSTANCE);\n    this.bootstrap = new ServerBootstrap()\n      .group(bossGroup, workerGroup)\n      .channel(NioServerSocketChannel.class);\n    this.conf = conf;\n    UserGroupInformation.setConfiguration(conf);\n  }\n\n  /**\n   * Start WebImageViewer and wait until the thread is interrupted.\n   * @param fsimage the fsimage to load.\n   * @throws IOException if failed to load the fsimage.\n   * @throws RuntimeException if security is enabled in configuration.\n   */\n  public void start(String fsimage) throws IOException {\n    try {\n      if (UserGroupInformation.isSecurityEnabled()) {\n        throw new RuntimeException(\n            \"WebImageViewer does not support secure mode. To start in \" +\n                \"non-secure mode, pass -D\" +\n                CommonConfigurationKeysPublic.HADOOP_SECURITY_AUTHENTICATION +\n                \"=simple\");\n      }\n      initServer(fsimage);\n      channel.closeFuture().await();\n    } catch (InterruptedException e) {\n      LOG.info(\"Interrupted. Stopping the WebImageViewer.\");\n      close();\n    }\n  }\n\n  /**\n   * Start WebImageViewer.\n   * @param fsimage the fsimage to load.\n   * @throws IOException if fail to load the fsimage.\n   */","sourceCodeStart":68,"sourceCodeEnd":104,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/tools/offlineImageViewer/WebImageViewer.java#L68-L104","documentation":"WebImageViewer (`hdfs oiv -p Web`, the default processor, `-addr host:port`) serves an unauthenticated read-only WebHDFS API over the fsimage and has no SPNEGO/Kerberos support. On start it checks UserGroupInformation.isSecurityEnabled() and refuses to run when the effective configuration sets hadoop.security.authentication=kerberos.","triggerScenarios":"Starting the viewer in an environment whose core-site.xml (or inherited configuration) enables Kerberos — e.g. running on a secured cluster node without overriding the setting.","commonSituations":"Running `hdfs oiv` on a Kerberized cluster host that picks up /etc/hadoop conf; CI containers built from cluster configuration.","solutions":["Force simple auth for the JVM as the message says: `HADOOP_OPTS=\"-Dhadoop.security.authentication=simple\" hdfs oiv -p Web -i <fsimage> -addr ...`","Or point `hdfs --config <dir>` at a stripped conf dir whose core-site.xml sets hadoop.security.authentication=simple","Because the endpoint is unauthenticated, bind to localhost (-addr 127.0.0.1:port) or a trusted network only"],"exampleFix":"# before: inherits the cluster's kerberos config\nhdfs oiv -p Web -i fsimage_0000000000000123456 -addr 0.0.0.0:11000\n# RuntimeException: WebImageViewer does not support secure mode...\n\n# after: force non-secure mode and bind loopback\nHADOOP_OPTS=\"-Dhadoop.security.authentication=simple\" \\\n  hdfs oiv -p Web -i fsimage_0000000000000123456 -addr 127.0.0.1:11000","handlingStrategy":"validation","validationCode":"Configuration conf = new Configuration();\nconf.set(CommonConfigurationKeysPublic.HADOOP_SECURITY_AUTHENTICATION, \"simple\");\nUserGroupInformation.setConfiguration(conf);\nif (UserGroupInformation.isSecurityEnabled()) {\n  throw new IllegalStateException(\n      \"WebImageViewer cannot start: Kerberos still enabled after forcing simple auth\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Run WebImageViewer with a dedicated non-secure conf dir (hdfs --config) instead of the cluster's","Always pass -Dhadoop.security.authentication=simple when running on Kerberized hosts","Bind the viewer to loopback (-addr 127.0.0.1:port): the API is unauthenticated"],"tags":["hdfs","offline-image-viewer","webhdfs","kerberos","security"],"backgroundTag":"kerberos-security-mode","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}