{"record":{"id":"b6247b355f4c6170","repo":"t8y2/dbx","slug":"decode-hive-delegation-token-w","errorCode":null,"errorMessage":"decode Hive delegation token: %w","messagePattern":"decode Hive delegation token: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/argo-go/config.go","lineNumber":746,"sourceCode":"\t\tif strings.EqualFold(strings.TrimSpace(candidate), key) {\n\t\t\treturn value\n\t\t}\n\t}\n\treturn \"\"\n}\n\nfunc applyDelegationToken(config *connectionConfig, values map[string]string) error {\n\tif !strings.EqualFold(config.Auth, \"DELEGATIONTOKEN\") && !strings.EqualFold(config.Auth, \"DELEGATION_TOKEN\") {\n\t\treturn nil\n\t}\n\ttoken := firstNonEmpty(parameter(values, \"delegationtoken\"), parameter(values, \"token\"), config.Password)\n\tif token == \"\" {\n\t\treturn errors.New(\"Hive delegation token authentication requires delegationToken, token, or password\")\n\t}\n\tconfig.DelegationToken = token\n\tidentifier, password, err := decodeHadoopDelegationToken(token)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"decode Hive delegation token: %w\", err)\n\t}\n\tconfig.Username = base64.StdEncoding.EncodeToString(identifier)\n\tconfig.Password = base64.StdEncoding.EncodeToString(password)\n\treturn nil\n}\n\nfunc decodeHadoopDelegationToken(value string) ([]byte, []byte, error) {\n\tencoded := strings.Join(strings.Fields(strings.TrimSpace(value)), \"\")\n\tif encoded == \"\" {\n\t\treturn nil, nil, errors.New(\"token is empty\")\n\t}\n\tvar decoded []byte\n\tvar decodeErr error\n\tfor _, encoding := range []*base64.Encoding{\n\t\tbase64.RawURLEncoding,\n\t\tbase64.URLEncoding,\n\t\tbase64.RawStdEncoding,\n\t\tbase64.StdEncoding,","sourceCodeStart":728,"sourceCodeEnd":764,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/argo-go/config.go#L728-L764","documentation":"This error wraps a failure to decode a Hadoop delegation token supplied for Hive delegation-token authentication. The token string is base64-decoded and parsed as a Hadoop TokenIdentifier protobuf-like structure; if that fails, this error is returned with the underlying cause. It indicates the provided token is malformed, not valid base64, or not a Hadoop delegation token.","triggerScenarios":"Opening a Hive connection with delegationToken/token (or password) set to a string that is not valid base64, is truncated, or does not follow the Hadoop delegation token wire format (identifier/password/kind/service fields).","commonSituations":"Token copied from the wrong service (not a Hive/Hadoop delegation token); token truncated by shell quoting or YAML folding; token from an expired Kerberos session re-encoded differently; passing an access token instead of a delegation token.","solutions":["Regenerate the delegation token from a valid Kerberos-authenticated Hive session (e.g. via GET_DELEGATION_TOKEN)","Ensure the token is the complete, correctly base64-encoded Hadoop token string","Check for truncation/corruption from shell escaping, YAML line folding, or secret-store encoding","Fall back to Kerberos or username/password auth if the token cannot be re-obtained"],"exampleFix":"// before\nconfig := Config{DelegationToken: truncatedToken}\n// after\ntoken, _ := fetchDelegationTokenFromHive()\nconfig := Config{DelegationToken: token}","handlingStrategy":"validation","validationCode":"func validateDelegationToken(token string) error {\n\tif token == \"\" { return errors.New(\"delegation token is empty\") }\n\tdecoded, err := base64.StdEncoding.DecodeString(token)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"token is not valid base64: %w\", err)\n\t}\n\tif len(decoded) < 8 {\n\t\treturn errors.New(\"token too short to be a Hadoop delegation token\")\n\t}\n\treturn nil\n}","typeGuard":null,"tryCatchPattern":"if err := cfg.ApplyDelegationToken(token); err != nil {\n\tvar de *fmt.Errorf\n\tif strings.Contains(err.Error(), \"decode Hive delegation token\") {\n\t\t// fall back to Kerberos auth or re-fetch token\n\t\treturn reauth()\n\t}\n\treturn err\n}","preventionTips":["Obtain tokens directly from the Hive server's GET_DELEGATION_TOKEN call","Store tokens in a secret manager, not in shell history or logs","Base64-validate the token before passing it to the driver","Refresh tokens before Kerberos ticket expiry"],"tags":["hive","authentication","delegation-token","base64"],"backgroundTag":"invalid-delegation-token","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}