{"record":{"id":"be5023fcf101de46","repo":"apache/hadoop","slug":"s-did-not-handle-the-s-delegation-token-oper","errorCode":null,"errorMessage":"'%s' did not handle the '%s' delegation token operation: %s","messagePattern":"'(.+?)' did not handle the '(.+?)' delegation token operation: (.+?)","errorType":"exception","errorClass":"AuthenticationException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/web/DelegationTokenAuthenticator.java","lineNumber":337,"sourceCode":"      // Unset delegation token to trigger fall-back authentication.\n      dt = ((DelegationTokenAuthenticatedURL.Token) token).getDelegationToken();\n      ((DelegationTokenAuthenticatedURL.Token) token).setDelegationToken(null);\n    }\n    HttpURLConnection conn = null;\n    try {\n      conn = aUrl.openConnection(url, token);\n      conn.setRequestMethod(operation.getHttpMethod());\n      HttpExceptionUtils.validateResponse(conn, HttpURLConnection.HTTP_OK);\n      if (hasResponse) {\n        String contentType = conn.getHeaderField(CONTENT_TYPE);\n        contentType =\n            (contentType != null) ? StringUtils.toLowerCase(contentType) : null;\n        if (contentType != null &&\n            contentType.contains(APPLICATION_JSON_MIME)) {\n          try {\n            ret = JsonSerialization.mapReader().readValue(conn.getInputStream());\n          } catch (Exception ex) {\n            throw new AuthenticationException(String.format(\n                \"'%s' did not handle the '%s' delegation token operation: %s\",\n                url.getAuthority(), operation, ex.getMessage()), ex);\n          }\n        } else {\n          throw new AuthenticationException(String.format(\"'%s' did not \" +\n                  \"respond with JSON to the '%s' delegation token operation\",\n              url.getAuthority(), operation));\n        }\n      }\n    } finally {\n      if (dt != null) {\n        ((DelegationTokenAuthenticatedURL.Token) token).setDelegationToken(dt);\n      }\n      if (conn != null) {\n        conn.disconnect();\n      }\n    }\n    return ret;","sourceCodeStart":319,"sourceCodeEnd":355,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/web/DelegationTokenAuthenticator.java#L319-L355","documentation":"During GETDELEGATIONTOKEN/RENEW (hasResponse=true), the client requires a JSON body and parses it with Jackson (JsonSerialization.mapReader().readValue(inputStream)). If the content-type claimed application/json but the body does not parse, the client throws AuthenticationException \"'<authority>' did not handle the '<op>' delegation token operation: <cause>\" - the server or an intermediary answered, but not with a parseable token response.","triggerScenarios":"doDelegationTokenOperation where conn content type contains application/json yet readValue fails: body is an HTML/text error mislabeled as JSON, truncated because the connection closed early, double-written by a proxy, or a different (older) server returning an incompatible payload.","commonSituations":"Gateway/proxy (Knox, nginx, SSL terminator) rewriting or padding responses; server returning an error page with a JSON content type; partial responses during network flaps; mixed-version clusters during rolling upgrades.","solutions":["Reproduce with curl -i --negotiate against the exact URL and inspect the raw body and Content-Type header.","Bypass the proxy/gateway to confirm the Hadoop endpoint itself answers valid JSON, then fix proxy passthrough.","Check the server log at that timestamp - the message embedded after ':' is the Jackson parse cause.","Align client and server Hadoop versions if an upgrade is mid-flight."],"exampleFix":"# before: opaque parse failure\n# \"'nn:1022' did not handle the 'GETDELEGATIONTOKEN' delegation token operation: Unexpected character ('<' ...)\ncurl -i --negotiate \"http://nn:1022/webhdfs/v1/?op=GETDELEGATIONTOKEN&renewer=hdfs\"\n# after: inspection reveals the proxy prepends <html>; fix upstream to pass JSON through untouched","handlingStrategy":"try-catch","validationCode":"// Pre-flight the endpoint with a raw HTTP client: any JSON op must answer JSON\nHttpURLConnection c = (HttpURLConnection) url.openConnection();\nString ct = c.getHeaderField(\"Content-Type\");\nif (ct == null || !ct.toLowerCase().contains(\"application/json\")) {\n  throw new IOException(\"Endpoint \" + url + \" is not token-JSON (Content-Type: \" + ct + \")\");\n}","typeGuard":null,"tryCatchPattern":"catch (AuthenticationException e) {\n  if (e.getMessage().contains(\"did not handle\")) {\n    // body was not valid JSON: dump the raw response via curl, check proxies/gateway\n  }\n  throw e;\n}","preventionTips":["Ensure gateways (Knox/nginx/SSL terminators) pass delegation-token responses through unmodified.","Smoke-test GETDELEGATIONTOKEN with curl -i during deployment and assert Content-Type + parseable body.","Pin client/server Hadoop versions during rolling upgrades."],"tags":["client","json","delegation-token","http","proxy"],"backgroundTag":"invalid-json-response","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}