{"record":{"id":"9d5fc3b89b182fe8","repo":"apache/hadoop","slug":"host-is-not-authorized-for-protocol","errorCode":null,"errorMessage":"Host {} is not authorized for protocol {}","messagePattern":"Host (.+?) is not authorized for protocol (.+?)","errorType":"exception","errorClass":"AuthorizationException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/authorize/ServiceAuthorizationManager.java","lineNumber":133,"sourceCode":"\n    }\n    if((clientPrincipal != null && !clientPrincipal.equals(user.getUserName())) || \n       acls.length != 2  || !acls[0].isUserAllowed(user) || acls[1].isUserAllowed(user)) {\n      String cause = clientPrincipal != null ?\n          \": this service is only accessible by \" + clientPrincipal :\n          \": denied by configured ACL\";\n      AUDITLOG.warn(AUTHZ_FAILED_FOR + user\n          + \" for protocol=\" + protocol + cause);\n      throw new AuthorizationException(\"User \" + user +\n          \" is not authorized for protocol \" + protocol + cause);\n    }\n    if (addr != null) {\n      String hostAddress = addr.getHostAddress();\n      if (hosts.length != 2 || !hosts[0].includes(hostAddress) ||\n          hosts[1].includes(hostAddress)) {\n        AUDITLOG.warn(AUTHZ_FAILED_FOR + \" for protocol=\" + protocol\n            + \" from host = \" +  hostAddress);\n        throw new AuthorizationException(\"Host \" + hostAddress +\n            \" is not authorized for protocol \" + protocol) ;\n      }\n    }\n    AUDITLOG.info(AUTHZ_SUCCESSFUL_FOR + user + \" for protocol=\"+protocol);\n  }\n\n  public void refresh(Configuration conf,\n                                          PolicyProvider provider) {\n    // Get the system property 'hadoop.policy.file'\n    String policyFile = \n      System.getProperty(\"hadoop.policy.file\", HADOOP_POLICY_FILE);\n    \n    // Make a copy of the original config, and load the policy file\n    Configuration policyConf = new Configuration(conf);\n    policyConf.addResource(policyFile);\n    refreshWithLoadedConfiguration(policyConf, provider);\n  }\n","sourceCodeStart":115,"sourceCodeEnd":151,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/authorize/ServiceAuthorizationManager.java#L115-L151","documentation":"ServiceAuthorizationManager.authorize throws AuthorizationException at the host level: the client InetAddress is not accepted for the protocol because the host ACL pair is malformed (hosts.length != 2), the address is not in the allow MachineList (hosts[0]), or it is in the block list (hosts[1]). This fires after the user ACL check passed, when addr is non-null.","triggerScenarios":"A client from an IP not covered by security.<protocol>.hosts (allow list), or listed in security.<protocol>.hosts.blocked, connecting over RPC with service authorization enabled.","commonSituations":"Tightening hadoop-policy.xml with host ACLs (e.g. security.client.protocol.hosts) and forgetting a subnet; machines added to the cluster but not to the allow list; blocked-list entries that accidentally match broad ranges.","solutions":["Add the denied host address (from the message) or its subnet to security.<protocol>.hosts in hadoop-policy.xml","Remove the address from security.<protocol>.hosts.blocked if it is denied there","Refresh service ACLs on the servers (dfsadmin -refreshServiceAcl / rmadmin -refreshServiceAcl) after editing","Prefer full ACL pairs (allow plus block) in policy edits so hosts.length stays 2"],"exampleFix":"<!-- hadoop-policy.xml: before -->\n<property>\n  <name>security.client.protocol.hosts</name>\n  <value>10.0.0.0/24</value>\n</property>\n<!-- client at 10.0.5.20 denied -->\n\n<!-- after -->\n<property>\n  <name>security.client.protocol.hosts</name>\n  <value>10.0.0.0/24,10.0.5.20</value>\n</property>","handlingStrategy":"try-catch","validationCode":"// client-side preflight: warn if the local address is outside the protocol host allow list\nString allow = policy.get(\"security.\" + protocolKey + \".hosts\");\nif (allow != null && !new MachineList(allow).includes(localAddr)) {\n  LOG.warn(\"Local address {} not in {} allow list; call will be denied\", localAddr, protocolKey);\n}","typeGuard":null,"tryCatchPattern":"try {\n  ServiceAuthorizationManager.authorize(user, protocol, conf, addr);\n} catch (AuthorizationException e) {\n  if (e.getMessage().startsWith(\"Host \")) {\n    // host ACL denial: fix security.<protocol>.hosts / .hosts.blocked\n  }\n  throw e;\n}","preventionTips":["Keep host ACL entries per protocol in sync with the cluster node list","Use CIDR ranges for subnets instead of enumerating single IPs","Review .hosts.blocked entries when broad ranges are denied unexpectedly"],"tags":["authorization","acl","host-acl","rpc","hadoop-policy","hadoop","security"],"backgroundTag":"acl-access-denied","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}