{"record":{"id":"e194644e09155256","repo":"apache/hadoop","slug":"renewer-is-trying-to-renew-a-token-formattokeni","errorCode":null,"errorMessage":"{renewer} is trying to renew a token {formatTokenId(id)} with wrong password","messagePattern":"(.+?) is trying to renew a token (.+?) with wrong password","errorType":"exception","errorClass":"AccessControlException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/AbstractDelegationTokenSecretManager.java","lineNumber":710,"sourceCode":"            Time.formatTime(now));\n      }\n      if ((id.getRenewer() == null) || (id.getRenewer().toString().isEmpty())) {\n        throw new AccessControlException(renewer + \" tried to renew a token \" + formatTokenId(id) +\n            \" without a renewer\");\n      }\n      if (!id.getRenewer().toString().equals(renewer)) {\n        throw new AccessControlException(renewer + \" tries to renew a token \" + formatTokenId(id) +\n            \" with non-matching renewer \" + id.getRenewer());\n      }\n      DelegationKey key = getDelegationKey(id.getMasterKeyId());\n      if (key == null) {\n        throw new InvalidToken(\"Unable to find master key for keyId=\" + id.getMasterKeyId() +\n            \" from cache. Failed to renew an unexpired token \" + formatTokenId(id) +\n            \" with sequenceNumber=\" + id.getSequenceNumber());\n      }\n      byte[] password = createPassword(token.getIdentifier(), key.getKey());\n      if (!MessageDigest.isEqual(password, token.getPassword())) {\n        throw new AccessControlException(\n            renewer + \" is trying to renew a token \" + formatTokenId(id) + \" with wrong password\");\n      }\n      long renewTime = Math.min(id.getMaxDate(), now + tokenRenewInterval);\n      String trackingId = getTrackingIdIfEnabled(id);\n      DelegationTokenInformation info =\n          new DelegationTokenInformation(renewTime, password, trackingId);\n\n      if (getTokenInfo(id) == null) {\n        throw new InvalidToken(\"Renewal request for unknown token \" + formatTokenId(id));\n      }\n      METRICS.trackUpdateToken(() -> updateToken(id, info));\n      return renewTime;\n    } finally {\n      this.apiLock.writeLock().unlock();\n    }\n  }\n  \n  /**","sourceCodeStart":692,"sourceCodeEnd":728,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/AbstractDelegationTokenSecretManager.java#L692-L728","documentation":"Error \"{renewer} is trying to renew a token {formatTokenId(id)} with wrong password\" thrown in apache/hadoop.","triggerScenarios":"Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/AbstractDelegationTokenSecretManager.java:710 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["The token password does not match the secret manager's stored password for {formatTokenId(id)}: the token is stale, forged, or the master key rolled. Obtain a fresh token from the service."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}