{"record":{"id":"b5180a524a8cc59c","repo":"apache/hadoop","slug":"the-configuration-does-not-define-the-token-kind","errorCode":null,"errorMessage":"The configuration does not define the token kind","messagePattern":"The configuration does not define the token kind","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/web/DelegationTokenAuthenticationHandler.java","lineNumber":157,"sourceCode":"   * services.\n   *\n   * @param secretManager a <code>DelegationTokenSecretManager</code> instance\n   */\n  public void setExternalDelegationTokenSecretManager(\n      AbstractDelegationTokenSecretManager secretManager) {\n    tokenManager.setExternalDelegationTokenSecretManager(secretManager);\n  }\n\n  @VisibleForTesting\n  @SuppressWarnings(\"unchecked\")\n  public void initTokenManager(Properties config) {\n    Configuration conf = new Configuration(false);\n    for (Map.Entry entry : config.entrySet()) {\n      conf.set((String) entry.getKey(), (String) entry.getValue());\n    }\n    String tokenKind = conf.get(TOKEN_KIND);\n    if (tokenKind == null) {\n      throw new IllegalArgumentException(\n          \"The configuration does not define the token kind\");\n    }\n    tokenKind = tokenKind.trim();\n    tokenManager = new DelegationTokenManager(conf, new Text(tokenKind));\n    tokenManager.init();\n  }\n\n  @VisibleForTesting\n  public void initJsonFactory(Properties config) {\n    boolean hasFeature = false;\n    JsonFactory tmpJsonFactory = new JsonFactory();\n\n    for (Map.Entry entry : config.entrySet()) {\n      String key = (String)entry.getKey();\n      if (key.startsWith(JSON_MAPPER_PREFIX)) {\n        JsonGenerator.Feature feature =\n            JsonGenerator.Feature.valueOf(key.substring(JSON_MAPPER_PREFIX\n                .length()));","sourceCodeStart":139,"sourceCodeEnd":175,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/web/DelegationTokenAuthenticationHandler.java#L139-L175","documentation":"initTokenManager() builds a DelegationTokenManager from the filter properties: every property is copied into a Configuration, then conf.get(\"delegation-token.token-kind\") (DelegationTokenAuthenticationHandler.TOKEN_KIND) must return the Text kind stamped on issued tokens. A null value throws IllegalArgumentException \"The configuration does not define the token kind\" during handler init, failing the whole auth filter.","triggerScenarios":"Deploying the DelegationTokenAuthenticationFilter without \"<auth-prefix>.delegation-token.token-kind\" in its config (e.g. hadoop.http.authentication.delegation-token.token-kind, hadoop.kms.authentication.delegation-token.token-kind); the property exists but under the wrong prefix or misspelled (tokenKind vs token-kind), so the trimmed lookup returns null.","commonSituations":"Upgrading to Hadoop versions where the kind became configurable and must match what clients validate (WEBHDFS, HDFS_DELEGATION_TOKEN, kms sort); KMS/WebHDFS sites with custom prefixes; hand-written filter configs that only set type/signer properties.","solutions":["Add <auth-prefix>.delegation-token.token-kind=<KIND> (e.g. hadoop.http.authentication.delegation-token.token-kind=WEBHDFS) matching the token kind clients expect.","Set the same kind on every HA node and on fronting gateways (HttpFS/KMS) so tokens interoperate.","Restart the web service so the handler re-initializes."],"exampleFix":"<!-- before -->\n<property>\n  <name>hadoop.http.authentication.type</name>\n  <value>kerberos</value>\n</property>\n<!-- after -->\n<property>\n  <name>hadoop.http.authentication.type</name>\n  <value>kerberos</value>\n</property>\n<property>\n  <name>hadoop.http.authentication.delegation-token.token-kind</name>\n  <value>WEBHDFS</value>\n</property>","handlingStrategy":"validation","validationCode":"// Deploy-time check: token kind must be set wherever the DT filter is deployed\nString kind = conf.get(\"hadoop.http.authentication.delegation-token.token-kind\");\nif (kind == null || kind.trim().isEmpty()) {\n  throw new IllegalArgumentException(\"token-kind missing under the auth prefix\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Set delegation-token.token-kind in the same template as authentication.type.","Use one kind across all HA nodes and gateways (WebHDFS/HttpFS/KMS) so tokens interoperate.","Add a post-deploy smoke test: GETDELEGATIONTOKEN and assert the returned token kind."],"tags":["configuration","authentication","delegation-token","token-kind"],"backgroundTag":"missing-config-property","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}