{"record":{"id":"a41015aaa1d675c8","repo":"apache/hadoop","slug":"fetcher-cannot-be-authenticated","errorCode":null,"errorMessage":"fetcher cannot be authenticated","messagePattern":"fetcher cannot be authenticated","errorType":"http","errorClass":"IOException","httpStatus":401,"severity":"error","filePath":"hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-shuffle/src/main/java/org/apache/hadoop/mapred/ShuffleChannelHandler.java","lineNumber":461,"sourceCode":"    }\n  }\n\n  protected void verifyRequest(String appid, ChannelHandlerContext ctx,\n                               HttpRequest request, HttpResponse response, URL requestUri)\n      throws IOException {\n    SecretKey tokenSecret = handlerCtx.secretManager.retrieveTokenSecret(appid);\n    if (null == tokenSecret) {\n      LOG.info(\"Request for unknown token {}, channel id: {}\", appid, ctx.channel().id());\n      throw new IOException(\"Could not find jobid\");\n    }\n    // encrypting URL\n    String encryptedURL = SecureShuffleUtils.buildMsgFrom(requestUri);\n    // hash from the fetcher\n    String urlHashStr =\n        request.headers().get(SecureShuffleUtils.HTTP_HEADER_URL_HASH);\n    if (urlHashStr == null) {\n      LOG.info(\"Missing header hash for {}, channel id: {}\", appid, ctx.channel().id());\n      throw new IOException(\"fetcher cannot be authenticated\");\n    }\n    if (LOG.isDebugEnabled()) {\n      int len = urlHashStr.length();\n      LOG.debug(\"Verifying request. encryptedURL:{}, hash:{}, channel id: \" +\n              \"{}\", encryptedURL,\n          urlHashStr.substring(len - len / 2, len - 1), ctx.channel().id());\n    }\n    // verify - throws exception\n    SecureShuffleUtils.verifyReply(urlHashStr, encryptedURL, tokenSecret);\n    // verification passed - encode the reply\n    String reply = SecureShuffleUtils.generateHash(urlHashStr.getBytes(StandardCharsets.UTF_8),\n        tokenSecret);\n    response.headers().set(\n        SecureShuffleUtils.HTTP_HEADER_REPLY_URL_HASH, reply);\n    // Put shuffle version into http header\n    response.headers().set(ShuffleHeader.HTTP_HEADER_NAME,\n        ShuffleHeader.DEFAULT_HTTP_HEADER_NAME);\n    response.headers().set(ShuffleHeader.HTTP_HEADER_VERSION,","sourceCodeStart":443,"sourceCodeEnd":479,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-shuffle/src/main/java/org/apache/hadoop/mapred/ShuffleChannelHandler.java#L443-L479","documentation":"Error \"fetcher cannot be authenticated\" thrown in apache/hadoop.","triggerScenarios":"Thrown by ShuffleChannelHandler when the shuffle secret/hash from the fetching reducer fails verification against the stored job credentials. Indicates a stale or forged shuffle token; the fetch is rejected and the reducer will fail and retry.","commonSituations":"Secure cluster with mismatched shuffle secret; clock skew or stale tokens after AM restart.","solutions":["Ensure the fetcher presents a valid shuffle secret/token: enable security consistently (hadoop.security.authentication) on both reducer and NodeManager.","Check that the shuffle secret key used by the JobHistory/token matches the NodeManager's; restart stale NodeManagers if keys rotated."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}