{"record":{"id":"e41e11258ad20f62","repo":"t8y2/dbx","slug":"hive-delegation-token-authentication-requires-dele-e41e11","errorCode":null,"errorMessage":"Hive delegation token authentication requires delegationToken, token, or password","messagePattern":"Hive delegation token authentication requires delegationToken, token, or password","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/hive-go/config.go","lineNumber":744,"sourceCode":"\treturn key\n}\n\nfunc hiveAssignmentValue(values map[string]string, key string) string {\n\tfor candidate, value := range values {\n\t\tif strings.EqualFold(strings.TrimSpace(candidate), key) {\n\t\t\treturn value\n\t\t}\n\t}\n\treturn \"\"\n}\n\nfunc applyDelegationToken(config *connectionConfig, values map[string]string) error {\n\tif !strings.EqualFold(config.Auth, \"DELEGATIONTOKEN\") && !strings.EqualFold(config.Auth, \"DELEGATION_TOKEN\") {\n\t\treturn nil\n\t}\n\ttoken := firstNonEmpty(parameter(values, \"delegationtoken\"), parameter(values, \"token\"), config.Password)\n\tif token == \"\" {\n\t\treturn errors.New(\"Hive delegation token authentication requires delegationToken, token, or password\")\n\t}\n\tconfig.DelegationToken = token\n\tidentifier, password, err := decodeHadoopDelegationToken(token)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"decode Hive delegation token: %w\", err)\n\t}\n\tconfig.Username = base64.StdEncoding.EncodeToString(identifier)\n\tconfig.Password = base64.StdEncoding.EncodeToString(password)\n\treturn nil\n}\n\nfunc decodeHadoopDelegationToken(value string) ([]byte, []byte, error) {\n\tencoded := strings.Join(strings.Fields(strings.TrimSpace(value)), \"\")\n\tif encoded == \"\" {\n\t\treturn nil, nil, errors.New(\"token is empty\")\n\t}\n\tvar decoded []byte\n\tvar decodeErr error","sourceCodeStart":726,"sourceCodeEnd":762,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/hive-go/config.go#L726-L762","documentation":"When Auth is DELEGATIONTOKEN (or DELEGATION_TOKEN), the driver resolves the token from the 'delegationToken' parameter, the 'token' parameter, or falls back to config.Password. If all three are empty, authentication cannot proceed and the config is rejected.","triggerScenarios":"Setting auth=DELEGATIONTOKEN without supplying delegationToken/token params or a password; fetching the token from an external service that failed silently and returned an empty string; passing the credential under a custom key the driver ignores.","commonSituations":"Kerberos setups where the delegation token is generated at runtime but injection into the DSN failed, switching from password auth to delegation-token auth while clearing the password, CI pipelines where the token secret wasn't provided.","solutions":["Set the delegationToken parameter (or the alias token) to the encoded Hadoop delegation token string.","As a fallback, set the password property to the token string — the driver accepts it as the token source.","Ensure the token acquisition step (e.g. from MetaStore or WebHDFS doAs endpoint) actually returned a non-empty token before connecting.","If you did not intend delegation-token auth, change auth to the intended mechanism."],"exampleFix":"// before\nparams := map[string]string{\"auth\": \"DELEGATIONTOKEN\"}\n// after\nparams := map[string]string{\"auth\": \"DELEGATIONTOKEN\", \"delegationToken\": tokenString}","handlingStrategy":"validation","validationCode":"func requireDelegationToken(params map[string]string) error {\n    if strings.EqualFold(params[\"auth\"], \"DELEGATIONTOKEN\") || strings.EqualFold(params[\"auth\"], \"DELEGATION_TOKEN\") {\n        if params[\"delegationToken\"] == \"\" && params[\"token\"] == \"\" && params[\"password\"] == \"\" {\n            return errors.New(\"delegation-token auth needs delegationToken, token, or password\")\n        }\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Set delegationToken explicitly rather than relying on password fallback","Acquire and validate the token before opening the connection","Keep token acquisition and connection setup in the same deployment step"],"tags":["hive","authentication","delegation-token","missing-credential"],"backgroundTag":"missing-credential","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}