{"record":{"id":"ee9f3c92ee6d6c85","repo":"apache/hadoop","slug":"authenticationmethod-token-authentication-requ","errorCode":null,"errorMessage":"AuthenticationMethod.TOKEN + \" authentication requires a secret manager\"","messagePattern":"AuthenticationMethod\\.TOKEN \\+ \" authentication requires a secret manager\"","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/ipc/Server.java","lineNumber":3577,"sourceCode":"        if (saslRpcServer.serverId != null) {\n          builder.setServerId(saslRpcServer.serverId);\n        }\n      }\n    }\n    return negotiateBuilder.build();\n  }\n\n  // get the security type from the conf. implicitly include token support\n  // if a secret manager is provided, or fail if token is the conf value but\n  // there is no secret manager\n  private List<AuthMethod> getAuthMethods(SecretManager<?> secretManager,\n                                             Configuration conf) {\n    AuthenticationMethod confAuthenticationMethod =\n        SecurityUtil.getAuthenticationMethod(conf);        \n    List<AuthMethod> authMethods = new ArrayList<AuthMethod>();\n    if (confAuthenticationMethod == AuthenticationMethod.TOKEN) {\n      if (secretManager == null) {\n        throw new IllegalArgumentException(AuthenticationMethod.TOKEN +\n            \" authentication requires a secret manager\");\n      } \n    } else if (secretManager != null) {\n      LOG.debug(\"{} authentication enabled for secret manager\", AuthenticationMethod.TOKEN);\n      // most preferred, go to the front of the line!\n      authMethods.add(AuthenticationMethod.TOKEN.getAuthMethod());\n    }\n    authMethods.add(confAuthenticationMethod.getAuthMethod());        \n    \n    LOG.debug(\"Server accepts auth methods:{}\", authMethods);\n    return authMethods;\n  }\n  \n  private void closeConnection(Connection connection) {\n    connectionManager.close(connection);\n  }\n\n  /**","sourceCodeStart":3559,"sourceCodeEnd":3595,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/ipc/Server.java#L3559-L3595","documentation":"Thrown while an IPC Server is being constructed (Server.getAuthMethods) when hadoop.security.authentication is set to TOKEN but the server was built with a null SecretManager. In Hadoop IPC, token (delegation token) authentication is not a standalone login method: it is implicitly enabled and put at the front of the accepted auth methods whenever a secret manager is supplied. Explicitly configuring TOKEN therefore only makes sense for tests; in a real deployment this exception means the authentication configuration is contradictory.","triggerScenarios":"core-site.xml (or the Configuration passed to new Server(...) / RPC.getServer / RPC.Builder.build) contains hadoop.security.authentication=token while the server constructor receives secretManager=null. Typical call path: new RPC.Builder(conf).setPort(...)...build() with no setSecretManager and the token value in conf.","commonSituations":"Copying a core-site.xml from documentation or test resources that uses 'token'; setting hadoop.security.authentication globally to experiment with token auth without wiring a delegation secret manager; leftover cluster-wide config overriding a service-specific setting after an upgrade or config merge.","solutions":["Set hadoop.security.authentication to 'simple' (no auth) or 'kerberos' (secure) in core-site.xml — token auth is not a valid standalone value for a production server.","If you truly need token auth in a test or embedded server, pass a non-null SecretManager (e.g., your service's delegation-token SecretManager) when constructing the RPC server so TOKEN is implied rather than configured.","Check for stray core-site.xml files earlier on the classpath (hadoop conf dirs, bundled test resources) that inject the token value without your knowledge."],"exampleFix":"// before (core-site.xml)\n<property><name>hadoop.security.authentication</name><value>token</value></property>\n\n// after\n<property><name>hadoop.security.authentication</name><value>kerberos</value></property>\n<!-- or 'simple'; token auth is implied by supplying a SecretManager to the server -->","handlingStrategy":"validation","validationCode":"AuthenticationMethod m = SecurityUtil.getAuthenticationMethod(conf);\nif (m == AuthenticationMethod.TOKEN && secretManager == null) {\n  throw new IllegalStateException(\"hadoop.security.authentication=token requires a SecretManager; \"\n      + \"use simple/kerberos or pass a SecretManager to the RPC server builder\");\n}\n// safe to construct the server here","typeGuard":null,"tryCatchPattern":"try {\n  server = new RPC.Builder(conf).setPort(port).setInstance(impl)\n      .setProtocol(Proto.class).build();\n} catch (IllegalArgumentException e) {\n  // message contains 'authentication requires a secret manager'\n  LOG.error(\"Invalid auth config: {}\", e.getMessage());\n  throw new ServiceInitializationException(e);\n}","preventionTips":["Never ship hadoop.security.authentication=token outside test code; token support is implied by supplying a SecretManager.","Add a config lint step (checkAuthenticationMethod vs server wiring) to deployment scripts.","Run a minimal RPC smoke test in CI with the production core-site.xml to catch contradictory auth settings before rollout."],"tags":["hadoop","ipc","authentication","configuration","secret-manager","security"],"backgroundTag":"auth-misconfiguration","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}