{"record":{"id":"d95fa2462fa2b238","repo":"apache/hadoop","slug":"security-is-enabled-but-block-access-tokens-via-d","errorCode":null,"errorMessage":"Security is enabled but block access tokens (via dfs.block.access.token.enable) aren't enabled. This may cause issues when clients attempt to connect to a DataNode. Aborting NameNode","messagePattern":"Security is enabled but block access tokens \\(via dfs\\.block\\.access\\.token\\.enable\\) aren't enabled\\. This may cause issues when clients attempt to connect to a DataNode\\. Aborting NameNode","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/blockmanagement/BlockManager.java","lineNumber":716,"sourceCode":"    LOG.info(\"encryptDataTransfer        = {}\", encryptDataTransfer);\n    LOG.info(\"maxNumBlocksToLog          = {}\", maxNumBlocksToLog);\n  }\n\n  private static BlockTokenSecretManager createBlockTokenSecretManager(\n      final Configuration conf) throws IOException {\n    final boolean isEnabled = conf.getBoolean(\n        DFSConfigKeys.DFS_BLOCK_ACCESS_TOKEN_ENABLE_KEY, \n        DFSConfigKeys.DFS_BLOCK_ACCESS_TOKEN_ENABLE_DEFAULT);\n    LOG.info(\"{} = {}\", DFSConfigKeys.DFS_BLOCK_ACCESS_TOKEN_ENABLE_KEY,\n            isEnabled);\n\n    if (!isEnabled) {\n      if (UserGroupInformation.isSecurityEnabled()) {\n        String errMessage = \"Security is enabled but block access tokens \" +\n            \"(via \" + DFSConfigKeys.DFS_BLOCK_ACCESS_TOKEN_ENABLE_KEY + \") \" +\n            \"aren't enabled. This may cause issues \" +\n            \"when clients attempt to connect to a DataNode. Aborting NameNode\";\n        throw new IOException(errMessage);\n      }\n      return null;\n    }\n\n    final long updateMin = conf.getLong(\n        DFSConfigKeys.DFS_BLOCK_ACCESS_KEY_UPDATE_INTERVAL_KEY, \n        DFSConfigKeys.DFS_BLOCK_ACCESS_KEY_UPDATE_INTERVAL_DEFAULT);\n    final long lifetimeMin = conf.getLong(\n        DFSConfigKeys.DFS_BLOCK_ACCESS_TOKEN_LIFETIME_KEY, \n        DFSConfigKeys.DFS_BLOCK_ACCESS_TOKEN_LIFETIME_DEFAULT);\n    final String encryptionAlgorithm = conf.get(\n        DFSConfigKeys.DFS_DATA_ENCRYPTION_ALGORITHM_KEY);\n    LOG.info(\"{}={} min(s), {}={} min(s), {}={}\",\n        DFSConfigKeys.DFS_BLOCK_ACCESS_KEY_UPDATE_INTERVAL_KEY, updateMin,\n        DFSConfigKeys.DFS_BLOCK_ACCESS_TOKEN_LIFETIME_KEY, lifetimeMin,\n        DFSConfigKeys.DFS_DATA_ENCRYPTION_ALGORITHM_KEY, encryptionAlgorithm);\n    \n    String nsId = DFSUtil.getNamenodeNameServiceId(conf);","sourceCodeStart":698,"sourceCodeEnd":734,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/blockmanagement/BlockManager.java#L698-L734","documentation":"In BlockManager block-access-token initialization, when dfs.block.access.token.enable is false the NameNode checks UserGroupInformation.isSecurityEnabled(): with Kerberos security on but block tokens off, it throws IOException and aborts NameNode startup. Without block tokens under Kerberos, DataNodes cannot mutually authenticate block operations, which silently breaks clients, so the NameNode refuses to start rather than run in a broken-secure mode.","triggerScenarios":"core-site.xml has hadoop.security.authentication=kerberos (security enabled) while hdfs-site.xml leaves dfs.block.access.token.enable=false (or explicitly false), then the NameNode starts.","commonSituations":"Enabling Kerberos on an existing cluster but missing this hdfs-site.xml step in the guide; config management roles (Puppet/Chef/Ansible) that roll hdfs-site.xml before core-site security settings; fresh secure-cluster installs from an insecure template.","solutions":["Set dfs.block.access.token.enable=true in hdfs-site.xml on all nodes (it must be consistent cluster-wide)","Restart the NameNode (and roll DataNodes with the updated config)","If this was a deliberate insecure test setup, instead disable Kerberos (hadoop.security.authentication=simple) - but never run security-on with tokens-off"],"exampleFix":"<!-- before -->\n<property><name>dfs.block.access.token.enable</name><value>false</value></property>\n\n<!-- after -->\n<property><name>dfs.block.access.token.enable</name><value>true</value></property>","handlingStrategy":"validation","validationCode":"static void validateSecureHdfsConf(Configuration conf) {\n  boolean securityOn = \"kerberos\".equalsIgnoreCase(conf.get(\"hadoop.security.authentication\", \"simple\"));\n  boolean tokensOff = !conf.getBoolean(DFSConfigKeys.DFS_BLOCK_ACCESS_TOKEN_ENABLE_KEY, DFSConfigKeys.DFS_BLOCK_ACCESS_TOKEN_ENABLE_DEFAULT);\n  if (securityOn && tokensOff) throw new IllegalStateException(\"Kerberos enabled but dfs.block.access.token.enable=false; NameNode will abort\");\n}","typeGuard":null,"tryCatchPattern":"catch (IOException e) { if (e.getMessage().contains(\"block access tokens\")) failDeploymentWithFix(e, \"set dfs.block.access.token.enable=true\"); else throw e; }","preventionTips":["Treat dfs.block.access.token.enable=true as mandatory in every secure (Kerberos) cluster template","Run the pairwise check (hadoop.security.authentication vs block tokens) as a pre-flight in config-management pipelines","Roll hdfs-site.xml and core-site.xml security settings in the same change window to avoid mismatched states"],"tags":["hdfs","namenode","security","kerberos","block-access-token","configuration","startup-check"],"backgroundTag":"security-misconfiguration","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}