{"record":{"id":"ddfb38db75f9ca34","repo":"apache/hadoop","slug":"server-asks-us-to-fall-back-to-simple-auth-but-th","errorCode":null,"errorMessage":"Server asks us to fall back to SIMPLE auth, but this client is configured to only allow secure connections.","messagePattern":"Server asks us to fall back to SIMPLE auth, but this client is configured to only allow secure connections\\.","errorType":"exception","errorClass":"AccessControlException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/ipc/Client.java","lineNumber":928,"sourceCode":"        return;\n      }\n      if (fallbackToSimpleAuth == null) {\n        // this should happen only during testing.\n        LOG.trace(\"Connection {} will skip to set fallbackToSimpleAuth as it is null.\", remoteId);\n      } else {\n        if (fallbackToSimpleAuth.get()) {\n          // we already set the value to true, we do not need to examine again.\n          return;\n        }\n      }\n      if (authMethod != AuthMethod.SIMPLE) {\n        if (fallbackToSimpleAuth != null) {\n          LOG.trace(\"Disabling fallbackToSimpleAuth, target does not use SIMPLE authentication.\");\n          fallbackToSimpleAuth.set(false);\n        }\n      } else if (UserGroupInformation.isSecurityEnabled()) {\n        if (!fallbackAllowed) {\n          throw new AccessControlException(\"Server asks us to fall back to SIMPLE auth, but this \"\n              + \"client is configured to only allow secure connections.\");\n        }\n        if (fallbackToSimpleAuth != null) {\n          LOG.trace(\"Enabling fallbackToSimpleAuth for target, as we are allowed to fall back.\");\n          fallbackToSimpleAuth.set(true);\n        }\n      }\n    }\n\n    private void closeConnection() {\n      if (socket == null) {\n        return;\n      }\n      // close the current connection\n      try {\n        socket.close();\n      } catch (IOException e) {\n        LOG.warn(\"Not able to close a socket\", e);","sourceCodeStart":910,"sourceCodeEnd":946,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/ipc/Client.java#L910-L946","documentation":"During SASL negotiation, the server told this client to fall back to SIMPLE authentication while the client JVM runs with Kerberos security enabled (UserGroupInformation.isSecurityEnabled()). Because ipc.client.fallback-to-simple-auth-allowed defaults to false, the client refuses and throws AccessControlException rather than silently downgrading to an unauthenticated connection.","triggerScenarios":"A Kerberos-enabled client (hadoop.security.authentication=kerberos) connecting to a service still running SIMPLE auth (no Kerberos on the server, e.g., an unsecured stand-by or a misconfigured gateway), with ipc.client.fallback-to-simple-auth-allowed unset/false; common when secure clusters talk to unsecured auxiliary services.","commonSituations":"Partially migrated clusters where some daemons are Kerberized and others are not; distcp/HDFS clients in a secure realm hitting a non-secure test cluster; Knox/gateway hops stripping SASL; config drift of hadoop.security.authentication between client and server.","solutions":["If falling back is acceptable, set ipc.client.fallback-to-simple-auth-allowed=true on the CLIENT configuration (core-site.xml of the connecting process).","Preferably, Kerberize the target server so client and server auth methods match.","Check which endpoint is answering: the 'server' may actually be an unsecured proxy or a wrong-addressed daemon (verify port/host).","Confirm hadoop.security.authentication is intentionally different on the two sides; align it if both should be secure."],"exampleFix":"# before (client core-site.xml)\n<!-- nothing set; default ipc.client.fallback-to-simple-auth-allowed=false -->\n\n# after\n<property>\n  <name>ipc.client.fallback-to-simple-auth-allowed</name>\n  <value>true</value>\n</property>","handlingStrategy":"fallback","validationCode":"// before issuing calls to a possibly-unsecured server:\nboolean securityEnabled = \"kerberos\".equals(conf.get(\"hadoop.security.authentication\"));\nif (securityEnabled) {\n  conf.setBoolean(\"ipc.client.fallback-to-simple-auth-allowed\", true); // only if policy permits plaintext\n}","typeGuard":null,"tryCatchPattern":"try {\n  call();\n} catch (AccessControlException e) {\n  if (e.getMessage() != null && e.getMessage().contains(\"fall back to SIMPLE auth\")) {\n    // decide: enable fallback config, or stop talking to this unsecured endpoint\n    throw new SecurityException(\"Refusing unsecured endpoint: \" + server, e);\n  }\n  throw e;\n}","preventionTips":["Kerberize all endpoints a secure client must contact, including auxiliary/gateway services.","Set ipc.client.fallback-to-simple-auth-allowed explicitly (true or false) so intent is recorded.","Verify the target host:port really is the intended daemon — misrouted connections look like auth mismatches.","Keep hadoop.security.authentication consistent across the tier during migrations."],"tags":["hadoop","ipc","kerberos","authentication","sasl","security","configuration"],"backgroundTag":"auth-method-mismatch","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}