{"record":{"id":"a71a973d4ac09af3","repo":"apache/hadoop","slug":"server-sent-unsolicited-challenge","errorCode":null,"errorMessage":"Server sent unsolicited challenge","messagePattern":"Server sent unsolicited challenge","errorType":"exception","errorClass":"SaslException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SaslRpcClient.java","lineNumber":429,"sourceCode":"              challengeToken = saslAuthType.getChallenge().toByteArray();\n              saslAuthType =\n                  SaslAuth.newBuilder(saslAuthType).clearChallenge().build();\n            } else if (saslClient.hasInitialResponse()) {\n              challengeToken = new byte[0];\n            }\n            responseToken = (challengeToken != null)\n                ? saslClient.evaluateChallenge(challengeToken)\n                    : new byte[0];\n          }\n          response = createSaslReply(SaslState.INITIATE, responseToken);\n          response.addAuths(saslAuthType);\n          break;\n        }\n        case CHALLENGE: {\n          if (saslClient == null) {\n            // should probably instantiate a client to allow a server to\n            // demand a specific negotiation\n            throw new SaslException(\"Server sent unsolicited challenge\");\n          }\n          byte[] responseToken = saslEvaluateToken(saslMessage, false);\n          response = createSaslReply(SaslState.RESPONSE, responseToken);\n          break;\n        }\n        case SUCCESS: {\n          // simple server sends immediate success to a SASL client for\n          // switch to simple\n          if (saslClient == null) {\n            authMethod = AuthMethod.SIMPLE;\n          } else {\n            saslEvaluateToken(saslMessage, true);\n          }\n          done = true;\n          break;\n        }\n        default: {\n          throw new SaslException(","sourceCodeStart":411,"sourceCodeEnd":447,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SaslRpcClient.java#L411-L447","documentation":"Error \"Server sent unsolicited challenge\" thrown in apache/hadoop.","triggerScenarios":"Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SaslRpcClient.java:429 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Retry the connection; an unsolicited challenge indicates client/server SASL state desynchronization.","Ensure only one authentication attempt runs per connection and stale connections are closed.","Align Hadoop versions on client and server to avoid SASL state machine mismatches."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}