{"record":{"id":"d5edabd4bdd03474","repo":"apache/hadoop","slug":"signer-secret-provider-zookeeper-path-must-be-spec","errorCode":null,"errorMessage":"signer.secret.provider.zookeeper.path must be specified","messagePattern":"signer\\.secret\\.provider\\.zookeeper\\.path must be specified","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"critical","filePath":"hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/util/ZKSignerSecretProvider.java","lineNumber":179,"sourceCode":"  @Override\n  public void init(Properties config, ServletContext servletContext,\n          long tokenValidity) throws Exception {\n    Object curatorClientObj = servletContext.getAttribute(\n            ZOOKEEPER_SIGNER_SECRET_PROVIDER_CURATOR_CLIENT_ATTRIBUTE);\n    if (curatorClientObj != null\n            && curatorClientObj instanceof CuratorFramework) {\n      client = (CuratorFramework) curatorClientObj;\n    } else {\n      client = createCuratorClient(config);\n      servletContext.setAttribute(\n          ZOOKEEPER_SIGNER_SECRET_PROVIDER_CURATOR_CLIENT_ATTRIBUTE, client);\n    }\n    this.tokenValidity = tokenValidity;\n    shouldDisconnect = Boolean.parseBoolean(\n            config.getProperty(DISCONNECT_FROM_ZOOKEEPER_ON_SHUTDOWN, \"true\"));\n    path = config.getProperty(ZOOKEEPER_PATH);\n    if (path == null) {\n      throw new IllegalArgumentException(ZOOKEEPER_PATH\n              + \" must be specified\");\n    }\n    try {\n      nextRolloverDate = System.currentTimeMillis() + tokenValidity;\n      // everyone tries to do this, only one will succeed and only when the\n      // znode doesn't already exist.  Everyone else will synchronize on the\n      // data from the znode\n      client.create().creatingParentsIfNeeded()\n              .forPath(path, generateZKData(generateRandomSecret(),\n              generateRandomSecret(), null));\n      zkVersion = 0;\n      LOG.info(\"Creating secret znode\");\n    } catch (KeeperException.NodeExistsException nee) {\n      LOG.info(\"The secret znode already exists, retrieving data\");\n    }\n    // Synchronize on the data from the znode\n    // passing true tells it to parse out all the data for initing\n    pullFromZK(true);","sourceCodeStart":161,"sourceCodeEnd":197,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/util/ZKSignerSecretProvider.java#L161-L197","documentation":"ZKSignerSecretProvider shares cookie-signing secrets across a cluster via ZooKeeper, storing them under the znode given by signer.secret.provider.zookeeper.path. During startup initialization this required property is read; a missing value throws IllegalArgumentException naming the property, aborting provider init.","triggerScenarios":"Configuring signer.secret.provider = zookeeper (for HA authentication filter) in the servlet/filter config without also setting signer.secret.provider.zookeeper.path.","commonSituations":"Enabling ZooKeeper-based secret sharing for multiple UI/proxy nodes and forgetting the path property; properties split across files where the auth filter config file lacks the path entry.","solutions":["Add signer.secret.provider.zookeeper.path (e.g. /hadoop-auth-secret) to the AuthenticationFilter configuration wherever zookeeper provider is enabled","Prefer the prefixed forms (signer.secret.provider.zookeeper.*) applied via the hadoop.auth.config.* prefix so they reach the filter","Restart the webapp after adding the property"],"exampleFix":"# before\nsigner.secret.provider=zookeeper\n# (no zookeeper.path set -> IllegalArgumentException)\n\n# after\nsigner.secret.provider=zookeeper\nsigner.secret.provider.zookeeper.path=/hadoop-auth-secret","handlingStrategy":"validation","validationCode":"String path = props.getProperty(\"signer.secret.provider.zookeeper.path\");\nif (\"zookeeper\".equals(props.getProperty(\"signer.secret.provider\")) && path == null) {\n  throw new IllegalArgumentException(\"zookeeper path required when using ZKSignerSecretProvider\");\n}","typeGuard":null,"tryCatchPattern":"config/init error — fail startup with a clear message listing the missing property; catching to default to a random secret would break cross-node SSO","preventionTips":["Template zookeeper provider configs as a unit: provider + path (+ auth options) together","Validate required properties in a config linter before deploy"],"tags":["hadoop-auth","zookeeper","secret-provider","configuration","startup"],"backgroundTag":"missing-config-property","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}