{"record":{"id":"a69758cbb76edd91","repo":"apache/hadoop","slug":"delegation-token-can-be-renewed-only-with-kerberos","errorCode":null,"errorMessage":"Delegation Token can be renewed only with kerberos or web authentication","messagePattern":"Delegation Token can be renewed only with kerberos or web authentication","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/FSNamesystem.java","lineNumber":6490,"sourceCode":"   * @param token token to renew\n   * @return new expiryTime of the token\n   * @throws InvalidToken if {@code token} is invalid\n   * @throws IOException on other errors\n   */\n  long renewDelegationToken(Token<DelegationTokenIdentifier> token)\n      throws InvalidToken, IOException {\n    final String operationName = \"renewDelegationToken\";\n    String tokenId = null;\n    long expiryTime;\n    checkOperation(OperationCategory.WRITE);\n    try {\n      writeLock(RwLockMode.FS);\n      try {\n        checkOperation(OperationCategory.WRITE);\n\n        checkNameNodeSafeMode(\"Cannot renew delegation token\");\n        if (!isAllowedDelegationTokenOp()) {\n          throw new IOException(\n              \"Delegation Token can be renewed only with kerberos or web \"\n                  + \"authentication\");\n        }\n        String renewer = getRemoteUser().getShortUserName();\n        expiryTime = dtSecretManager.renewToken(token, renewer);\n        final DelegationTokenIdentifier id = DFSUtil.decodeDelegationToken(\n            token);\n        getEditLog().logRenewDelegationToken(id, expiryTime);\n        tokenId = id.toStringStable();\n      } finally {\n        writeUnlock(RwLockMode.FS, operationName, getLockReportInfoSupplier(tokenId));\n      }\n    } catch (AccessControlException ace) {\n      final DelegationTokenIdentifier id = DFSUtil.decodeDelegationToken(token);\n      tokenId = id.toStringStable();\n      logAuditEvent(false, operationName, tokenId);\n      throw ace;\n    }","sourceCodeStart":6472,"sourceCodeEnd":6508,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/FSNamesystem.java#L6472-L6508","documentation":"Error \"Delegation Token can be renewed only with kerberos or web authentication\" thrown in apache/hadoop.","triggerScenarios":"A client calls renewDelegationToken on a connection that is not Kerberos- or web-authenticated.","commonSituations":"Renewing a token from a host without valid Kerberos credentials or on a simple-auth cluster.","solutions":["Use Kerberos or web authentication to renew delegation tokens; simple authentication connections cannot renew tokens."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}