{"record":{"id":"f861bcdd91906f2e","repo":"t8y2/dbx","slug":"hive-jwt-authentication-requires-jwt-or-the-jwt-en","errorCode":null,"errorMessage":"Hive JWT authentication requires jwt or the JWT environment variable","messagePattern":"Hive JWT authentication requires jwt or the JWT environment variable","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/argo-go/config.go","lineNumber":580,"sourceCode":"\tconfig.BrowserToken = firstNonEmpty(parameter(values, \"browsertoken\"), parameter(values, \"token\"))\n\tconfig.BrowserClientID = parameter(values, \"browserclientidentifier\")\n\tif value := parameter(values, \"browserresponseport\"); value != \"\" {\n\t\tparsed, err := strconv.Atoi(value)\n\t\tif err != nil || parsed < 0 || parsed > 65535 {\n\t\t\treturn fmt.Errorf(\"invalid Hive browserResponsePort %q: expected 0-65535\", value)\n\t\t}\n\t\tconfig.BrowserResponsePort = parsed\n\t}\n\tif value := parameter(values, \"browserresponsetimeout\"); value != \"\" {\n\t\tparsed, err := strconv.ParseInt(value, 10, 64)\n\t\tif err != nil || parsed <= 0 {\n\t\t\treturn fmt.Errorf(\"invalid Hive browserResponseTimeout %q: expected positive seconds\", value)\n\t\t}\n\t\tconfig.BrowserResponseTimeout = time.Duration(parsed) * time.Second\n\t}\n\tconfig.BrowserDisableSSLCheck = parameterBool(values, \"browserdisablesslcheck\")\n\tif strings.EqualFold(config.Auth, \"JWT\") && config.JWT == \"\" {\n\t\treturn errors.New(\"Hive JWT authentication requires jwt or the JWT environment variable\")\n\t}\n\tif value := parameter(values, \"fetchsize\"); value != \"\" {\n\t\tparsed, err := strconv.Atoi(value)\n\t\tif err != nil || parsed <= 0 {\n\t\t\treturn fmt.Errorf(\"invalid Hive fetchSize %q: expected a positive integer\", value)\n\t\t}\n\t\tconfig.FetchSize = parsed\n\t}\n\tif value := parameter(values, \"sockettimeout\"); value != \"\" {\n\t\tparsed, err := strconv.ParseInt(value, 10, 64)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"invalid Hive socketTimeout %q: expected seconds\", value)\n\t\t}\n\t\tif parsed > 0 {\n\t\t\tconfig.SocketTimeout = time.Duration(parsed) * time.Second\n\t\t}\n\t}\n\tif value := parameter(values, \"thrift.client.max.message.size\"); value != \"\" {","sourceCodeStart":562,"sourceCodeEnd":598,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/argo-go/config.go#L562-L598","documentation":"When the auth scheme is JWT, the driver requires a JWT credential: either the jwt connection parameter or the JWT environment variable. If config.Auth is \"JWT\" (case-insensitive) and config.JWT is empty, applyAuthParameters returns this error, since JWT auth cannot proceed without a token.","triggerScenarios":"Building a connection with auth=JWT in the connection string/parameters but omitting the jwt parameter and the JWT environment variable.","commonSituations":"Setting auth=JWT copied from a sample but forgetting the token; the JWT env var not exported in the deployment environment (container/CI); token passed under a wrong parameter name.","solutions":["Add jwt=<token> to the connection parameters","Set the JWT environment variable expected by the driver before running","Switch auth to a scheme you can satisfy (e.g. NONE, LDAP, DELEGATIONTOKEN) if JWT credentials are unavailable"],"exampleFix":"// before\njdbc:hive2://host:10000/default?auth=JWT\n// after\njdbc:hive2://host:10000/default?auth=JWT&jwt=<token>","handlingStrategy":"validation","validationCode":"if strings.EqualFold(auth, \"JWT\") && jwtParam == \"\" && os.Getenv(\"JWT\") == \"\" {\n    return errors.New(\"JWT auth selected but no token provided\")\n}","typeGuard":null,"tryCatchPattern":"cfg, err := buildConnectionConfig(params)\nif err != nil {\n    if strings.Contains(err.Error(), \"JWT authentication requires\") { /* prompt for token */ }\n    return err\n}","preventionTips":["When using auth=JWT, always set jwt=... or export the JWT env var in the runtime environment","Check secret mounting in containers/CI — an empty secret silently breaks JWT auth","Use a preflight config validator that checks required params per auth scheme"],"tags":["go","hive","jwt","authentication","configuration"],"backgroundTag":"missing-jwt-credentials","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}