{"record":{"id":"fa19ae0fe79c4764","repo":"apache/hadoop","slug":"this-should-not-happen-ex-getmessage","errorCode":null,"errorMessage":"This should not happen: ${ex.getMessage()}","messagePattern":"This should not happen: (.+?)","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/web/DelegationTokenAuthenticator.java","lineNumber":284,"sourceCode":"   * being authenticated by the configured <code>Authenticator</code>.\n   *\n   * @param url the URL to cancel the delegation token from. Only HTTP/S URLs\n   * are supported.\n   * @param token the authentication token with the Delegation Token to cancel.\n   * @param dToken abstract delegation token identifier.\n   * @param doAsUser the user to do as, which will be the token owner.\n   * @throws IOException if an IO error occurred.\n   */\n  public void cancelDelegationToken(URL url,\n      AuthenticatedURL.Token token,\n      Token<AbstractDelegationTokenIdentifier> dToken, String doAsUser)\n      throws IOException {\n    try {\n      doDelegationTokenOperation(url, token,\n          DelegationTokenOperation.CANCELDELEGATIONTOKEN, null, dToken, false,\n          doAsUser);\n    } catch (AuthenticationException ex) {\n      throw new IOException(\"This should not happen: \" + ex.getMessage(), ex);\n    }\n  }\n\n  private Map doDelegationTokenOperation(URL url,\n      AuthenticatedURL.Token token, DelegationTokenOperation operation,\n      String renewer, Token<?> dToken, boolean hasResponse, String doAsUser)\n      throws IOException, AuthenticationException {\n    Map ret = null;\n    Map<String, String> params = new HashMap<String, String>();\n    params.put(OP_PARAM, operation.toString());\n    if (renewer != null) {\n      params.put(RENEWER_PARAM, renewer);\n    }\n    if (dToken != null) {\n      params.put(TOKEN_PARAM, dToken.encodeToUrlString());\n    }\n    // proxyuser\n    if (doAsUser != null) {","sourceCodeStart":266,"sourceCodeEnd":302,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/web/DelegationTokenAuthenticator.java#L266-L302","documentation":"Client-side DelegationTokenAuthenticator.cancelDelegationToken only declares IOException, so when the shared doDelegationTokenOperation throws AuthenticationException (server returned an error status via HttpExceptionUtils.validateResponse, or the auth layer failed), cancel wraps it: IOException \"This should not happen: <msg>\". \"Should not happen\" because cancellation posts the token itself and normally never exercises authentication - an exception here really means the server rejected the cancel request.","triggerScenarios":"CANCELDELEGATIONTOKEN against a server that answers non-HTTP_OK: token already expired/canceled and unknown to the server, 403 from proxyuser/ownership checks, wrong URL, SPNEGO handshake failure, or a proxy returning an error page.","commonSituations":"Canceling after the token expired and was removed from the token store; canceling a token owned by another user; pointing the cancel at a non-token-aware endpoint; version mismatch where the server error payload changes.","solutions":["Unwrap the cause: IOException.getCause() is the AuthenticationException with the server's message (e.g. 404 vs 403 detail).","Verify you are canceling a currently-valid token you own (or via an authorized proxyuser) at the URL that issued it.","Check the server-side log for the corresponding DelegationTokenAuthenticationHandler entry.","Treat already-canceled/expired as success if your workflow only needs the token unusable."],"exampleFix":"// before\ntry { authUrl.cancelDelegationToken(url, authToken, dt, doAs); }\ncatch (IOException e) { throw e; }\n// after: surface the real server-side reason\ntry { authUrl.cancelDelegationToken(url, authToken, dt, doAs); }\ncatch (IOException e) {\n  if (e.getCause() instanceof AuthenticationException) {\n    LOG.warn(\"cancel rejected by server: {}\", e.getCause().getMessage());\n    return; // token unknown/expired -> already effectively canceled\n  }\n  throw e;\n}","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  authUrl.cancelDelegationToken(url, authToken, dt, doAs);\n} catch (IOException e) {\n  if (e.getCause() instanceof AuthenticationException) {\n    String msg = e.getCause().getMessage();\n    if (msg.contains(\"404\") || msg.contains(\"unknown\")) { /* already invalid: done */ }\n    else if (msg.contains(\"403\")) { /* ownership/proxyuser: fix caller identity */ }\n    else { throw e; }\n  } else { throw e; }\n}","preventionTips":["Only cancel tokens you own (or through an authorized proxyuser).","Treat already-expired/canceled as success in cancel workflows.","Keep client and server Hadoop versions aligned so error payloads parse as expected."],"tags":["client","delegation-token","token-cancel","http","ioexception"],"backgroundTag":"delegation-token-cancel-failed","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}