{"record":{"id":"baaa3649ec621236","repo":"apache/hadoop","slug":"could-not-read-httpfs-signature-secret-file-0","errorCode":null,"errorMessage":"Could not read HttpFS signature secret file: {0}","messagePattern":"Could not read HttpFS signature secret file: (.+?)","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"critical","filePath":"hadoop-hdfs-project/hadoop-hdfs-httpfs/src/main/java/org/apache/hadoop/fs/http/server/HttpFSAuthenticationFilter.java","lineNumber":105,"sourceCode":"          Paths.get(signatureSecretFile)), StandardCharsets.UTF_8)) {\n        StringBuilder secret = new StringBuilder();\n        int c = reader.read();\n        while (c > -1) {\n          secret.append((char) c);\n          c = reader.read();\n        }\n\n        String secretString = secret.toString();\n        if (secretString.isEmpty()) {\n          throw new RuntimeException(\n              \"No secret in HttpFs signature secret file: \"\n                  + signatureSecretFile);\n        }\n\n        props.setProperty(AuthenticationFilter.SIGNATURE_SECRET,\n            secretString);\n      } catch (IOException ex) {\n        throw new RuntimeException(\"Could not read HttpFS signature \"\n            + \"secret file: \" + signatureSecretFile);\n      }\n    }\n    setAuthHandlerClass(props);\n    String dtkind = WebHdfsConstants.WEBHDFS_TOKEN_KIND.toString();\n    if (conf.getBoolean(HttpFSServerWebServer.SSL_ENABLED_KEY, false)) {\n      dtkind = WebHdfsConstants.SWEBHDFS_TOKEN_KIND.toString();\n    }\n    props.setProperty(KerberosDelegationTokenAuthenticationHandler.TOKEN_KIND,\n                      dtkind);\n    return props;\n  }\n\n  protected Configuration getProxyuserConfiguration(FilterConfig filterConfig) {\n    Map<String, String> proxyuserConf = HttpFSServerWebApp.get().getConfig().\n        getValByRegex(\"httpfs\\\\.proxyuser\\\\.\");\n    Configuration conf = new Configuration(false);\n    for (Map.Entry<String, String> entry : proxyuserConf.entrySet()) {","sourceCodeStart":87,"sourceCodeEnd":123,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-hdfs-project/hadoop-hdfs-httpfs/src/main/java/org/apache/hadoop/fs/http/server/HttpFSAuthenticationFilter.java#L87-L123","documentation":"HttpFSAuthenticationFilter opens the file given by httpfs.authentication.signature.secret.file to load the cookie-signing secret. If opening or reading it throws IOException (file deleted, unreadable permissions, path is a directory), init wraps it as RuntimeException('Could not read HttpFS signature secret file: <path>') and the webapp fails to start.","triggerScenarios":"The secret file was present at configure time but removed before/at startup; the httpfs daemon user lacks read permission (file owned by root with mode 600); the path points to a directory or a symlink whose target is gone; NFS/Kerberos-protected mount not mounted when HttpFS starts.","commonSituations":"Secrets distributed to only some nodes of an HttpFS HA pair; file created as root during manual install and never chowned; containers where the secret volume is mounted after process start; SELinux denying the read (manifests as IOException).","solutions":["Verify the exact path from the message exists and is a regular file: ls -l <path>.","Grant read access to the httpfs run user: chown httpfs <path>; chmod 400 <path> (or appropriate ACL).","Restart HttpFS after the fix; if using containers, ensure the secret volume is mounted before the JVM starts."],"exampleFix":"# before\n$ ls -l /etc/hadoop/security/httpfs-signature-secret\n-rw------- 1 root root 32 ... # httpfs user cannot read\n\n# after\n$ chown httpfs:hadoop /etc/hadoop/security/httpfs-signature-secret\n$ chmod 400 /etc/hadoop/security/httpfs-signature-secret\n$ systemctl restart httpfs","handlingStrategy":"validation","validationCode":"# verify readable by the daemon user before start\nSECRET=/etc/hadoop/security/httpfs-signature-secret\nsudo -u httpfs test -r \"$SECRET\" || { echo \"FATAL: $SECRET not readable by httpfs\"; exit 1; }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["chown httpfs + chmod 400 the secret file at provision time.","Mount secret volumes before process start in containers (depends_on / initContainer ordering).","Periodically verify secret presence on every HttpFS node, not just one."],"tags":["httpfs","hadoop-auth","signature-secret","file-permissions","configuration","startup-failure"],"backgroundTag":"secret-file-unreadable","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}