{"record":{"id":"a02707e51c78b6e1","repo":"t8y2/dbx","slug":"token-identifier-and-password-must-be-non-empty-a02707","errorCode":null,"errorMessage":"token identifier and password must be non-empty","messagePattern":"token identifier and password must be non-empty","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/hive-go/config.go","lineNumber":787,"sourceCode":"\t\tdecoded, decodeErr = encoding.DecodeString(encoded)\n\t\tif decodeErr == nil {\n\t\t\tbreak\n\t\t}\n\t}\n\tif decodeErr != nil {\n\t\treturn nil, nil, decodeErr\n\t}\n\treader := strings.NewReader(string(decoded))\n\tidentifier, err := readHadoopByteArray(reader)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"identifier: %w\", err)\n\t}\n\tpassword, err := readHadoopByteArray(reader)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"password: %w\", err)\n\t}\n\tif len(identifier) == 0 || len(password) == 0 {\n\t\treturn nil, nil, errors.New(\"token identifier and password must be non-empty\")\n\t}\n\tif _, err := readHadoopByteArray(reader); err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"kind: %w\", err)\n\t}\n\tif _, err := readHadoopByteArray(reader); err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"service: %w\", err)\n\t}\n\tif reader.Len() != 0 {\n\t\treturn nil, nil, errors.New(\"token contains trailing data\")\n\t}\n\treturn identifier, password, nil\n}\n\nfunc readHadoopByteArray(reader io.ByteReader) ([]byte, error) {\n\tlength, err := readHadoopVInt(reader)\n\tif err != nil {\n\t\treturn nil, err\n\t}","sourceCodeStart":769,"sourceCodeEnd":805,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/hive-go/config.go#L769-L805","documentation":"A Hadoop delegation token is a serialized structure of length-prefixed byte arrays: identifier, password, kind, service. After decoding base64 and reading identifier and password, the driver requires both to be non-empty; an empty either means the bytes are not a valid delegation token structure.","triggerScenarios":"Passing a base64 string that decodes but is not a Hadoop token (e.g. an opaque JWT, an access token from another system, or arbitrary text base64-encoded); a truncated token whose length prefixes don't match; tokens from a different Hadoop version with a different serialization.","commonSituations":"Developers pasting a JWT where a Hadoop delegation token is expected, copying tokens between clusters/formats, tokens re-encoded with padding or line breaks that corrupted structure.","solutions":["Regenerate the delegation token from the Hadoop service (e.g. via MetaStore getToken or kinit + hive token tooling) and use that exact base64 blob.","Verify you are not substituting a JWT or OAuth token for a Hadoop delegation token.","Check the token's serialization: it should decode into identifier/password/kind/service byte arrays; use a Hadoop utility to round-trip it if unsure."],"exampleFix":"// before\nparams[\"delegationToken\"] = idToken // wrong token type (JWT)\n// after\nparams[\"delegationToken\"] = hadoopDelegationToken // base64 of Hadoop Token identifier+password+kind+service","handlingStrategy":"validation","validationCode":"func looksLikeHadoopToken(b64 string) error {\n    raw, err := base64.StdEncoding.DecodeString(strings.Join(strings.Fields(b64), \"\"))\n    if err != nil || len(raw) < 4 {\n        return fmt.Errorf(\"not a plausible hadoop token\")\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Only pass tokens issued by Hadoop/Hive token machinery, never JWTs or OAuth tokens","Round-trip decode the token once at acquisition to catch corruption early","Regenerate tokens per session instead of hand-copying them"],"tags":["hive","authentication","delegation-token","serialization"],"backgroundTag":"token-format-invalid","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}