{"record":{"id":"cc6c724e597e04ca","repo":"apache/hadoop","slug":"config-property-type-doesn-t-exist","errorCode":null,"errorMessage":"Config property type doesn't exist","messagePattern":"Config property type doesn't exist","errorType":"exception","errorClass":"ServletException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/web/DelegationTokenAuthenticationFilter.java","lineNumber":132,"sourceCode":"  @Override\n  protected Properties getConfiguration(String configPrefix,\n      FilterConfig filterConfig) throws ServletException {\n    Properties props = super.getConfiguration(configPrefix, filterConfig);\n    setAuthHandlerClass(props);\n    return props;\n  }\n\n  /**\n   * Set AUTH_TYPE property to the name of the corresponding authentication\n   * handler class based on the input properties.\n   * @param props input properties.\n   * @throws ServletException servlet exception.\n   */\n  protected void setAuthHandlerClass(Properties props)\n      throws ServletException {\n    String authType = props.getProperty(AUTH_TYPE);\n    if (authType == null) {\n      throw new ServletException(\"Config property \"\n          + AUTH_TYPE + \" doesn't exist\");\n    }\n    if (authType.equals(PseudoAuthenticationHandler.TYPE)) {\n      props.setProperty(AUTH_TYPE,\n          PseudoDelegationTokenAuthenticationHandler.class.getName());\n    } else if (authType.equals(KerberosAuthenticationHandler.TYPE)) {\n      props.setProperty(AUTH_TYPE,\n          KerberosDelegationTokenAuthenticationHandler.class.getName());\n    } else if (authType.equals(MultiSchemeAuthenticationHandler.TYPE)) {\n      props.setProperty(AUTH_TYPE,\n          MultiSchemeDelegationTokenAuthenticationHandler.class.getName());\n    }\n  }\n\n  /**\n   * Returns the proxyuser configuration. All returned properties must start\n   * with <code>proxyuser.</code>'\n   * <p>","sourceCodeStart":114,"sourceCodeEnd":150,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/web/DelegationTokenAuthenticationFilter.java#L114-L150","documentation":"DelegationTokenAuthenticationFilter is the HTTP auth layer for WebHDFS/KMS/HttpFS. At init it reads the standard AuthenticationFilter properties and rewrites the \"type\" property to the delegation-token-aware handler (simple -> PseudoDelegationTokenAuthenticationHandler, kerberos -> Kerberos..., multi-scheme -> ...). setAuthHandlerClass throws ServletException \"Config property type doesn't exist\" at filter initialization when the auth type property is entirely absent, which prevents the web application from starting.","triggerScenarios":"The filter config (built from the auth prefix, e.g. hadoop.http.authentication.*, dfs.web.authentication.*, hadoop.kms.authentication.*) contains no \"<prefix>.type\" entry, so props.getProperty(AUTH_TYPE) returns null during filter init().","commonSituations":"Enabling Kerberos HTTP auth but forgetting hadoop.http.authentication.type in core-site.xml; kms-site.xml missing hadoop.kms.authentication.type after an upgrade; property placed under the wrong prefix (typo) so the filter never sees it; config file not on the web app's classpath.","solutions":["Set the type property under the correct prefix: hadoop.http.authentication.type=simple|kerberos|multi-scheme (or <kms/httpfs>.authentication.type for those services).","Confirm the config file carrying the property is loaded by the web app (core-site.xml on the NameNode/HttpFS/KMS classpath).","Redeploy/restart the web application so the filter re-initializes."],"exampleFix":"<!-- before: auth configured without type -->\n<property>\n  <name>hadoop.http.authentication.kerberos.principal</name>\n  <value>HTTP/_HOST@EXAMPLE.COM</value>\n</property>\n<!-- after: add the type -->\n<property>\n  <name>hadoop.http.authentication.type</name>\n  <value>kerberos</value>\n</property>","handlingStrategy":"validation","validationCode":"// Deploy-time check: the auth filter config must carry a type entry\nString type = conf.get(\"hadoop.http.authentication.type\");\nif (type == null || !Arrays.asList(\"simple\", \"kerberos\", \"multi-scheme\").contains(type)) {\n  throw new IllegalArgumentException(\n      \"hadoop.http.authentication.type must be simple|kerberos|multi-scheme\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Templatize auth config: always set type together with principal/keytab properties in one block.","Validate filter config with a config-lint step in deployment pipelines.","Prefer hadoop.http.authentication.* prefix consistency across all HTTP endpoints."],"tags":["servlet-filter","authentication","configuration","http"],"backgroundTag":"missing-config-property","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}