t8y2/dbx · error

decode Hive delegation token: %w

Error message

decode Hive delegation token: %w

What it means

This error wraps a failure to decode the Hive delegation token supplied for token-based authentication. The driver passes the token to decodeHadoopDelegationToken, which parses the Hadoop token binary format into identifier and password parts; if that parsing fails (bad base64, malformed structure, empty token), the error is wrapped with this prefix. It occurs during config construction for Kerberos/delegation-token auth.

Source

Thrown at agents/drivers/hive-go/config.go:749

		if strings.EqualFold(strings.TrimSpace(candidate), key) {
			return value
		}
	}
	return ""
}

func applyDelegationToken(config *connectionConfig, values map[string]string) error {
	if !strings.EqualFold(config.Auth, "DELEGATIONTOKEN") && !strings.EqualFold(config.Auth, "DELEGATION_TOKEN") {
		return nil
	}
	token := firstNonEmpty(parameter(values, "delegationtoken"), parameter(values, "token"), config.Password)
	if token == "" {
		return errors.New("Hive delegation token authentication requires delegationToken, token, or password")
	}
	config.DelegationToken = token
	identifier, password, err := decodeHadoopDelegationToken(token)
	if err != nil {
		return fmt.Errorf("decode Hive delegation token: %w", err)
	}
	config.Username = base64.StdEncoding.EncodeToString(identifier)
	config.Password = base64.StdEncoding.EncodeToString(password)
	return nil
}

func decodeHadoopDelegationToken(value string) ([]byte, []byte, error) {
	encoded := strings.Join(strings.Fields(strings.TrimSpace(value)), "")
	if encoded == "" {
		return nil, nil, errors.New("token is empty")
	}
	var decoded []byte
	var decodeErr error
	for _, encoding := range []*base64.Encoding{
		base64.RawURLEncoding,
		base64.URLEncoding,
		base64.RawStdEncoding,
		base64.StdEncoding,

View on GitHub (pinned to c0390bff16)

Solutions

1. Re-fetch a fresh delegation token from the Hadoop delegation token endpoint and pass it unmodified
2. Verify the token is valid base64 and preserves the exact binary blob (no wrapping/trimming)
3. Confirm the token is a Hadoop Hive delegation token, not another credential type

Example fix

// before
cfg.SetDelegationToken(os.Getenv("HIVE_JWT")) // wrong token type
// after
cfg.SetDelegationToken(os.Getenv("HIVE_DELEGATION_TOKEN")) // raw Hadoop token string

func looksLikeBase64Token(s string) bool {
	_, err := base64.StdEncoding.DecodeString(s)
	return err == nil && len(s) > 0
}

err := cfg.ApplyDelegationToken(token)
if err != nil {
	var derr error
	if errors.As(err, &derr) && strings.Contains(err.Error(), "decode Hive delegation token") {
		return fmt.Errorf("refetch token from server: %w", err)
	}
	return err
}

When it happens

Trigger: Calling the config builder with delegationToken, token, or password set to a value that is empty-ish, not valid base64, or not a valid Hadoop delegation token structure.

Common situations: Copying a token that was truncated or reformatted (line wraps, whitespace, quotes) in transit; using a token from a different Hadoop service or version with an incompatible layout; passing an OIDC/JWT token instead of a Hadoop delegation token.

Related errors

• Hive delegation token authentication requires delegationToke
• token is empty
• token identifier and password must be non-empty
• token contains trailing data
• Hive delegation token authentication requires delegationToke

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/e578ff642570956f. Report an issue: GitHub.