{"record":{"id":"e8c2483e745e5f30","repo":"apache/hadoop","slug":"this-login-authentication-is-not-supported","errorCode":null,"errorMessage":"\" + this + \" login authentication is not supported","messagePattern":"\" \\+ this \\+ \" login authentication is not supported","errorType":"exception","errorClass":"UnsupportedOperationException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/UserGroupInformation.java","lineNumber":1497,"sourceCode":"    \n    private final AuthMethod authMethod;\n    private final String loginAppName;\n    \n    private AuthenticationMethod(AuthMethod authMethod) {\n      this(authMethod, null);\n    }\n    private AuthenticationMethod(AuthMethod authMethod, String loginAppName) {\n      this.authMethod = authMethod;\n      this.loginAppName = loginAppName;\n    }\n    \n    public AuthMethod getAuthMethod() {\n      return authMethod;\n    }\n    \n    String getLoginAppName() {\n      if (loginAppName == null) {\n        throw new UnsupportedOperationException(\n            this + \" login authentication is not supported\");\n      }\n      return loginAppName;\n    }\n    \n    public static AuthenticationMethod valueOf(AuthMethod authMethod) {\n      for (AuthenticationMethod value : values()) {\n        if (value.getAuthMethod() == authMethod) {\n          return value;\n        }\n      }\n      throw new IllegalArgumentException(\n          \"no authentication method for \" + authMethod);\n    }\n  };\n\n  /**\n   * Create a proxy user using username of the effective user and the ugi of the","sourceCodeStart":1479,"sourceCodeEnd":1515,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/UserGroupInformation.java#L1479-L1515","documentation":"AuthenticationMethod.getLoginAppName() returns the JAAS application name used for login. Only SIMPLE and KERBEROS carry one; TOKEN, CERTIFICATE, KERBEROS_SSL and PROXY are constructed with null and throw UnsupportedOperationException when asked for it. Reached from UGI login internals (HadoopConfiguration) when something attempts a JAAS login under a method that has none.","triggerScenarios":"Driving UGI's login machinery (getLoginAppName via HadoopConfiguration.getAppConfigurationEntry) while the configured AuthenticationMethod is TOKEN/CERTIFICATE/KERBEROS_SSL/PROXY - e.g., calling loginUserFromKeytab-style flows when hadoop.security.authentication is not kerberos, or calling AuthenticationMethod.TOKEN.getLoginAppName() directly.","commonSituations":"hadoop.security.authentication=-simple while code assumes keytab login; token/delegation-token services accidentally invoking the Kerberos login path; switch statements over the enum calling getLoginAppName without a guard.","solutions":["Set hadoop.security.authentication=kerberos in core-site.xml before using login APIs","Only call getLoginAppName() (or the login flows behind it) for SIMPLE/KERBEROS","Guard enum handling: skip JAAS login for methods without a login app name"],"exampleFix":"// before\nString app = authMethod.getLoginAppName(); // throws for TOKEN/PROXY/...\n// after\nString app = (authMethod == AuthenticationMethod.SIMPLE\n    || authMethod == AuthenticationMethod.KERBEROS)\n        ? authMethod.getLoginAppName() : null;","handlingStrategy":"type-guard","validationCode":"private static final Set<AuthenticationMethod> JAAS_CAPABLE =\n    EnumSet.of(AuthenticationMethod.SIMPLE, AuthenticationMethod.KERBEROS);\nif (!JAAS_CAPABLE.contains(authMethod)) {\n  throw new UnsupportedOperationException(\n      authMethod + \" cannot perform JAAS login\");\n}","typeGuard":"static boolean supportsJaasLogin(\n    UserGroupInformation.AuthenticationMethod m) {\n  return m == UserGroupInformation.AuthenticationMethod.SIMPLE\n      || m == UserGroupInformation.AuthenticationMethod.KERBEROS;\n}","tryCatchPattern":null,"preventionTips":["Set hadoop.security.authentication=kerberos before using login APIs","Never call getLoginAppName on TOKEN/CERTIFICATE/KERBEROS_SSL/PROXY","Centralize enum dispatch so every new constant is handled explicitly"],"tags":["hadoop","ugi","authentication-method","jaas"],"backgroundTag":"unsupported-authentication-method","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}