{"record":{"id":"e578ff642570956f","repo":"t8y2/dbx","slug":"decode-hive-delegation-token-w-e578ff","errorCode":null,"errorMessage":"decode Hive delegation token: %w","messagePattern":"decode Hive delegation token: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/hive-go/config.go","lineNumber":749,"sourceCode":"\t\tif strings.EqualFold(strings.TrimSpace(candidate), key) {\n\t\t\treturn value\n\t\t}\n\t}\n\treturn \"\"\n}\n\nfunc applyDelegationToken(config *connectionConfig, values map[string]string) error {\n\tif !strings.EqualFold(config.Auth, \"DELEGATIONTOKEN\") && !strings.EqualFold(config.Auth, \"DELEGATION_TOKEN\") {\n\t\treturn nil\n\t}\n\ttoken := firstNonEmpty(parameter(values, \"delegationtoken\"), parameter(values, \"token\"), config.Password)\n\tif token == \"\" {\n\t\treturn errors.New(\"Hive delegation token authentication requires delegationToken, token, or password\")\n\t}\n\tconfig.DelegationToken = token\n\tidentifier, password, err := decodeHadoopDelegationToken(token)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"decode Hive delegation token: %w\", err)\n\t}\n\tconfig.Username = base64.StdEncoding.EncodeToString(identifier)\n\tconfig.Password = base64.StdEncoding.EncodeToString(password)\n\treturn nil\n}\n\nfunc decodeHadoopDelegationToken(value string) ([]byte, []byte, error) {\n\tencoded := strings.Join(strings.Fields(strings.TrimSpace(value)), \"\")\n\tif encoded == \"\" {\n\t\treturn nil, nil, errors.New(\"token is empty\")\n\t}\n\tvar decoded []byte\n\tvar decodeErr error\n\tfor _, encoding := range []*base64.Encoding{\n\t\tbase64.RawURLEncoding,\n\t\tbase64.URLEncoding,\n\t\tbase64.RawStdEncoding,\n\t\tbase64.StdEncoding,","sourceCodeStart":731,"sourceCodeEnd":767,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/hive-go/config.go#L731-L767","documentation":"This error wraps a failure to decode the Hive delegation token supplied for token-based authentication. The driver passes the token to decodeHadoopDelegationToken, which parses the Hadoop token binary format into identifier and password parts; if that parsing fails (bad base64, malformed structure, empty token), the error is wrapped with this prefix. It occurs during config construction for Kerberos/delegation-token auth.","triggerScenarios":"Calling the config builder with delegationToken, token, or password set to a value that is empty-ish, not valid base64, or not a valid Hadoop delegation token structure.","commonSituations":"Copying a token that was truncated or reformatted (line wraps, whitespace, quotes) in transit; using a token from a different Hadoop service or version with an incompatible layout; passing an OIDC/JWT token instead of a Hadoop delegation token.","solutions":["Re-fetch a fresh delegation token from the Hadoop delegation token endpoint and pass it unmodified","Verify the token is valid base64 and preserves the exact binary blob (no wrapping/trimming)","Confirm the token is a Hadoop Hive delegation token, not another credential type"],"exampleFix":"// before\ncfg.SetDelegationToken(os.Getenv(\"HIVE_JWT\")) // wrong token type\n// after\ncfg.SetDelegationToken(os.Getenv(\"HIVE_DELEGATION_TOKEN\")) // raw Hadoop token string","handlingStrategy":"try-catch","validationCode":"func looksLikeBase64Token(s string) bool {\n\t_, err := base64.StdEncoding.DecodeString(s)\n\treturn err == nil && len(s) > 0\n}","typeGuard":null,"tryCatchPattern":"err := cfg.ApplyDelegationToken(token)\nif err != nil {\n\tvar derr error\n\tif errors.As(err, &derr) && strings.Contains(err.Error(), \"decode Hive delegation token\") {\n\t\treturn fmt.Errorf(\"refetch token from server: %w\", err)\n\t}\n\treturn err\n}","preventionTips":["Fetch tokens fresh at connect time rather than long-lived copies","Store tokens in raw form; avoid editors/clipboard reflow altering bytes","Ensure the credential type is a Hadoop Hive delegation token"],"tags":["hive","kerberos","delegation-token","auth"],"backgroundTag":"delegation-token-decode-failed","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}