t8y2/dbx · error

decode Hive delegation token: %w

Error message

decode Hive delegation token: %w

What it means

This error wraps a failure to decode a Hadoop delegation token supplied for Hive delegation-token authentication. The token string is base64-decoded and parsed as a Hadoop TokenIdentifier protobuf-like structure; if that fails, this error is returned with the underlying cause. It indicates the provided token is malformed, not valid base64, or not a Hadoop delegation token.

Source

Thrown at agents/drivers/argo-go/config.go:746

		if strings.EqualFold(strings.TrimSpace(candidate), key) {
			return value
		}
	}
	return ""
}

func applyDelegationToken(config *connectionConfig, values map[string]string) error {
	if !strings.EqualFold(config.Auth, "DELEGATIONTOKEN") && !strings.EqualFold(config.Auth, "DELEGATION_TOKEN") {
		return nil
	}
	token := firstNonEmpty(parameter(values, "delegationtoken"), parameter(values, "token"), config.Password)
	if token == "" {
		return errors.New("Hive delegation token authentication requires delegationToken, token, or password")
	}
	config.DelegationToken = token
	identifier, password, err := decodeHadoopDelegationToken(token)
	if err != nil {
		return fmt.Errorf("decode Hive delegation token: %w", err)
	}
	config.Username = base64.StdEncoding.EncodeToString(identifier)
	config.Password = base64.StdEncoding.EncodeToString(password)
	return nil
}

func decodeHadoopDelegationToken(value string) ([]byte, []byte, error) {
	encoded := strings.Join(strings.Fields(strings.TrimSpace(value)), "")
	if encoded == "" {
		return nil, nil, errors.New("token is empty")
	}
	var decoded []byte
	var decodeErr error
	for _, encoding := range []*base64.Encoding{
		base64.RawURLEncoding,
		base64.URLEncoding,
		base64.RawStdEncoding,
		base64.StdEncoding,

View on GitHub (pinned to c0390bff16)

Solutions

1. Regenerate the delegation token from a valid Kerberos-authenticated Hive session (e.g. via GET_DELEGATION_TOKEN)
2. Ensure the token is the complete, correctly base64-encoded Hadoop token string
3. Check for truncation/corruption from shell escaping, YAML line folding, or secret-store encoding
4. Fall back to Kerberos or username/password auth if the token cannot be re-obtained

Example fix

// before
config := Config{DelegationToken: truncatedToken}
// after
token, _ := fetchDelegationTokenFromHive()
config := Config{DelegationToken: token}

func validateDelegationToken(token string) error {
	if token == "" { return errors.New("delegation token is empty") }
	decoded, err := base64.StdEncoding.DecodeString(token)
	if err != nil {
		return fmt.Errorf("token is not valid base64: %w", err)
	}
	if len(decoded) < 8 {
		return errors.New("token too short to be a Hadoop delegation token")
	}
	return nil
}

if err := cfg.ApplyDelegationToken(token); err != nil {
	var de *fmt.Errorf
	if strings.Contains(err.Error(), "decode Hive delegation token") {
		// fall back to Kerberos auth or re-fetch token
		return reauth()
	}
	return err
}

When it happens

Trigger: Opening a Hive connection with delegationToken/token (or password) set to a string that is not valid base64, is truncated, or does not follow the Hadoop delegation token wire format (identifier/password/kind/service fields).

Common situations: Token copied from the wrong service (not a Hive/Hadoop delegation token); token truncated by shell quoting or YAML folding; token from an expired Kerberos session re-encoded differently; passing an access token instead of a delegation token.

Related errors

• token is empty
• Hive delegation token authentication requires delegationToke
• token is empty
• Hive delegation token authentication requires delegationToke
• token identifier and password must be non-empty

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/b6247b355f4c6170. Report an issue: GitHub.