{"record":{"id":"ad877941ac512d7d","repo":"apache/hadoop","slug":"security-is-enabled-but-block-access-tokens-via-d-ad8779","errorCode":null,"errorMessage":"Security is enabled but block access tokens (via dfs.block.access.token.enable) aren't enabled. This may cause issues when clients attempt to connect to a DataNode. Aborting DataNode","messagePattern":"Security is enabled but block access tokens \\(via dfs\\.block\\.access\\.token\\.enable\\) aren't enabled\\. This may cause issues when clients attempt to connect to a DataNode\\. Aborting DataNode","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"critical","filePath":"hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/datanode/DataNode.java","lineNumber":2012,"sourceCode":"   * @throws RuntimeException if security enabled, but configuration is insecure\n   */\n  private static void checkSecureConfig(DNConf dnConf, Configuration conf,\n      SecureResources resources) throws RuntimeException {\n    if (!UserGroupInformation.isSecurityEnabled()) {\n      return;\n    }\n\n    // Abort out of inconsistent state if Kerberos is enabled\n    // but block access tokens are not enabled.\n    boolean isEnabled = conf.getBoolean(\n        DFSConfigKeys.DFS_BLOCK_ACCESS_TOKEN_ENABLE_KEY,\n        DFSConfigKeys.DFS_BLOCK_ACCESS_TOKEN_ENABLE_DEFAULT);\n    if (!isEnabled) {\n      String errMessage = \"Security is enabled but block access tokens \" +\n          \"(via \" + DFSConfigKeys.DFS_BLOCK_ACCESS_TOKEN_ENABLE_KEY + \") \" +\n          \"aren't enabled. This may cause issues \" +\n          \"when clients attempt to connect to a DataNode. Aborting DataNode\";\n      throw new RuntimeException(errMessage);\n    }\n\n    if (dnConf.getIgnoreSecurePortsForTesting()) {\n      return;\n    }\n\n    if (resources != null) {\n      final boolean httpSecured = resources.isHttpPortPrivileged()\n          || DFSUtil.getHttpPolicy(conf) == HttpConfig.Policy.HTTPS_ONLY;\n      final boolean rpcSecured = resources.isRpcPortPrivileged()\n          || resources.isSaslEnabled();\n\n      // Allow secure DataNode to startup if:\n      // 1. Http is secure.\n      // 2. Rpc is secure\n      if (rpcSecured && httpSecured) {\n        return;\n      }","sourceCodeStart":1994,"sourceCodeEnd":2030,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/datanode/DataNode.java#L1994-L2030","documentation":"checkSecureConfig runs during DN startup in secure deployments: when Kerberos is active but dfs.block.access.token.enable is false, the DN aborts with this RuntimeException. Block access tokens are how an authenticated client proves to a DataNode it may read or write a block; without them a 'secure' cluster's DNs would accept unauthenticated block traffic, so the DN refuses to run.","triggerScenarios":"hadoop.security.authentication=kerberos (with the DN in secure mode) while dfs.block.access.token.enable is missing or false in the DN's hdfs-site.xml — typically a partial security rollout where some hosts never received the key.","commonSituations":"Kerberizing a cluster host-by-host; a distro's minimal hdfs-site.xml lacking the key; test-to-prod config drift; re-enabling security after it was temporarily disabled.","solutions":["Set dfs.block.access.token.enable=true in hdfs-site.xml and push it to ALL nodes (NameNode and DataNodes), then restart the DN","Audit every host: hdfs getconf -confKey dfs.block.access.token.enable must print true where DNs run","While at it, confirm dfs.block.access.key.update.interval and dfs.block.access.token.lifetime are sane"],"exampleFix":"<!-- before: Kerberos on, tokens off -> DN aborts -->\n<!-- dfs.block.access.token.enable absent (default false) -->\n<!-- after -->\n<property><name>dfs.block.access.token.enable</name><value>true</value></property>","handlingStrategy":"validation","validationCode":"boolean kerberos = \"kerberos\".equalsIgnoreCase(conf.get(CommonConfigurationKeys.HADOOP_SECURITY_AUTHENTICATION));\nboolean tokens = conf.getBoolean(DFSConfigKeys.DFS_BLOCK_ACCESS_TOKEN_ENABLE_KEY,\n    DFSConfigKeys.DFS_BLOCK_ACCESS_TOKEN_ENABLE_DEFAULT);\nif (kerberos && !tokens) {\n  throw new IllegalStateException(\"Kerberos enabled but dfs.block.access.token.enable=false — DN will abort\");\n}","typeGuard":null,"tryCatchPattern":"catch (RuntimeException e) {\n  if (e.getMessage().contains(\"block access tokens\")) {\n    // set dfs.block.access.token.enable=true in hdfs-site.xml on all nodes and restart the DN\n  }\n}","preventionTips":["Treat dfs.block.access.token.enable=true as mandatory whenever Kerberos is on","Audit with 'hdfs getconf -confKey dfs.block.access.token.enable' across all hosts during kerberization","Keep NN and DN hdfs-site.xml in sync from one template source"],"tags":["hadoop","hdfs","datanode","kerberos","security","configuration","startup"],"backgroundTag":"security-misconfiguration","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}