{"record":{"id":"a67b79cd353acf23","repo":"apache/hadoop","slug":"could-not-read-signature-secret-file-signatures","errorCode":null,"errorMessage":"Could not read signature secret file: ${signatureSecretFile}","messagePattern":"Could not read signature secret file: (.+?)","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"critical","filePath":"hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/util/FileSignerSecretProvider.java","lineNumber":62,"sourceCode":"        AuthenticationFilter.SIGNATURE_SECRET_FILE, null);\n\n    if (signatureSecretFile != null) {\n      try (Reader reader = new InputStreamReader(Files.newInputStream(\n              Paths.get(signatureSecretFile)), StandardCharsets.UTF_8)) {\n        StringBuilder sb = new StringBuilder();\n        int c = reader.read();\n        while (c > -1) {\n          sb.append((char) c);\n          c = reader.read();\n        }\n\n        secret = sb.toString().getBytes(StandardCharsets.UTF_8);\n        if (secret.length == 0) {\n          throw new RuntimeException(\"No secret in signature secret file: \"\n             + signatureSecretFile);\n        }\n      } catch (IOException ex) {\n        throw new RuntimeException(\"Could not read signature secret file: \" +\n            signatureSecretFile);\n      }\n    }\n\n    secrets = new byte[][]{secret};\n  }\n\n  @Override\n  public byte[] getCurrentSecret() {\n    return secret;\n  }\n\n  @Override\n  public byte[][] getAllSecrets() {\n    return secrets;\n  }\n}\n","sourceCodeStart":44,"sourceCodeEnd":80,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/util/FileSignerSecretProvider.java#L44-L80","documentation":"While FileSignerSecretProvider streams the signature.secret.file content, any IOException (file missing, directory unreadable, permission denied) is rethrown as this RuntimeException, and provider initialization fails, preventing the webapp/filter from starting.","triggerScenarios":"signature.secret.file points to a nonexistent path; the file exists but the service user lacks read permission; the parent directory is not traversable; an NFS mount holding the file is down.","commonSituations":"Typo in the path inside the authentication filter config; secret file provisioned with root-only permissions; container images that omit the secrets volume.","solutions":["Verify the exact path from the config exists: 'ls -l <signature.secret.file>'","Grant read access to the service user ('chown' / 'chmod 640') and check parent directory traverse bits","If the file lives on a network mount, confirm the mount is up before starting the service"],"exampleFix":"# before\nsignature.secret.file=/etc/hadoop/auth-secret.pem   # file does not exist\n\n# after: create the file with a secret and correct ownership\nhead -c 64 /dev/urandom | base64 > /etc/hadoop/auth-secret\nchown hadoop:hadoop /etc/hadoop/auth-secret && chmod 640 /etc/hadoop/auth-secret","handlingStrategy":"validation","validationCode":"java.nio.file.Path p = java.nio.file.Paths.get(cfg.getProperty(\"signature.secret.file\"));\nif (!java.nio.file.Files.isReadable(p)) {\n  throw new IllegalStateException(\"secret file not readable: \" + p);\n}","typeGuard":null,"tryCatchPattern":"catch (RuntimeException e) thrown during provider init is fatal — correct the path/permissions and restart; do not catch-and-continue without a signer secret","preventionTips":["Run 'ls -l' as the service user on the secret path during provisioning","Keep secret files owned by the service account with mode 640","Pin absolute paths in config to avoid cwd-dependent resolution"],"tags":["hadoop-auth","secret-provider","configuration","file-permissions"],"backgroundTag":"missing-secret-file","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}