{"record":{"id":"bb8ea5e047ec7db9","repo":"apache/hadoop","slug":"authentication-type-must-be-specified-simple-kerb","errorCode":null,"errorMessage":"Authentication type must be specified: simple|kerberos|<class>","messagePattern":"Authentication type must be specified: simple\\|kerberos\\|<class>","errorType":"exception","errorClass":"ServletException","httpStatus":null,"severity":"critical","filePath":"hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/server/AuthenticationFilter.java","lineNumber":164,"sourceCode":"\n  /**\n   * <p>Initializes the authentication filter and signer secret provider.</p>\n   * It instantiates and initializes the specified {@link\n   * AuthenticationHandler}.\n   *\n   * @param filterConfig filter configuration.\n   *\n   * @throws ServletException thrown if the filter or the authentication handler could not be initialized properly.\n   */\n  @Override\n  public void init(FilterConfig filterConfig) throws ServletException {\n    String configPrefix = filterConfig.getInitParameter(CONFIG_PREFIX);\n    configPrefix = (configPrefix != null) ? configPrefix + \".\" : \"\";\n    config = getConfiguration(configPrefix, filterConfig);\n    String authHandlerName = config.getProperty(AUTH_TYPE, null);\n    String authHandlerClassName;\n    if (authHandlerName == null) {\n      throw new ServletException(\"Authentication type must be specified: \" +\n          PseudoAuthenticationHandler.TYPE + \"|\" + \n          KerberosAuthenticationHandler.TYPE + \"|<class>\");\n    }\n    authHandlerClassName =\n        AuthenticationHandlerUtil\n            .getAuthenticationHandlerClassName(authHandlerName);\n    maxInactiveInterval = Long.parseLong(config.getProperty(\n        AUTH_TOKEN_MAX_INACTIVE_INTERVAL, \"-1\")); // By default, disable.\n    if (maxInactiveInterval > 0) {\n      maxInactiveInterval *= 1000;\n    }\n    validity = Long.parseLong(config.getProperty(AUTH_TOKEN_VALIDITY, \"36000\"))\n        * 1000; //10 hours\n    initializeSecretProvider(filterConfig);\n\n    initializeAuthHandler(authHandlerClassName, filterConfig);\n\n    cookieDomain = config.getProperty(COOKIE_DOMAIN, null);","sourceCodeStart":146,"sourceCodeEnd":182,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/server/AuthenticationFilter.java#L146-L182","documentation":"AuthenticationFilter.init reads its configuration (with the configured prefix), looks up the 'type' property, and refuses to start with ServletException if no authentication type is given — the message lists the expected values: simple (PseudoAuthenticationHandler.TYPE), kerberos (KerberosAuthenticationHandler.TYPE), or a custom AuthenticationHandler class name. A filter that fails init takes the whole web application down, so this surfaces as a deployment error at context startup, not at request time.","triggerScenarios":"Deploying the hadoop-auth AuthenticationFilter (directly or via WebHDFS/httpfs/Oozie/etc.) with web.xml or config missing the authentication.type property; setting a config-prefix (config.prefix init-param) so 'type' is expected as prefix.type while the property is stored unprefixed (or vice versa); typos in the property name.","commonSituations":"Copying a filter definition from docs but dropping the init-params; adding a prefix after the fact without renaming existing properties; XML property outside the right section; environment-specific web.xml overlays losing the param; upgrading a service whose new version reads the type under a new name.","solutions":["Add the init-param to the filter in web.xml: param-name 'type', param-value 'kerberos', 'simple', or your handler FQCN — or set it in the external config the filter loads.","If config.prefix is set, verify every property carries that prefix (e.g. prefix.type) and matches exactly.","Check for typos/case in property names and ensure the XML is well-formed (no lost params during merge).","For custom handlers, confirm the class is on the classpath and implements AuthenticationHandler, otherwise the type resolves to nothing.","Redeploy and watch the startup log: init failures are logged before any request can succeed."],"exampleFix":"<!-- web.xml — before: filter has no authentication type -->\n<filter>\n  <filter-name>auth</filter-name>\n  <filter-class>org.apache.hadoop.security.authentication.server.AuthenticationFilter</filter-class>\n</filter>\n\n<!-- after -->\n<filter>\n  <filter-name>auth</filter-name>\n  <filter-class>org.apache.hadoop.security.authentication.server.AuthenticationFilter</filter-class>\n  <init-param>\n    <param-name>type</param-name>\n    <param-value>kerberos</param-value>\n  </init-param>\n</filter>","handlingStrategy":"validation","validationCode":"// deployment check before the filter ever initializes\nProperties p = loadAuthConfig();\nif (p.getProperty(\"type\") == null && p.getProperty(prefix + \".type\") == null) {\n  throw new IllegalArgumentException(\"authentication.type missing: set type=simple|kerberos|<handler-class>\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Include the authentication.type init-param in every filter definition (or its prefixed equivalent).","Validate the auth configuration in integration tests that boot the filter.","When using config.prefix, re-check that all properties carry the prefix."],"tags":["configuration","servlet-filter","hadoop-auth","deployment","authentication-type"],"backgroundTag":"missing-filter-config","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}