Hive delegation token authentication requires delegationToke

Error message

Hive delegation token authentication requires delegationToken, token, or password

What it means

When Auth is DELEGATIONTOKEN (or DELEGATION_TOKEN), the driver resolves the token from the 'delegationToken' parameter, the 'token' parameter, or falls back to config.Password. If all three are empty, authentication cannot proceed and the config is rejected.

Source

Thrown at agents/drivers/hive-go/config.go:744

	return key
}

func hiveAssignmentValue(values map[string]string, key string) string {
	for candidate, value := range values {
		if strings.EqualFold(strings.TrimSpace(candidate), key) {
			return value
		}
	}
	return ""
}

func applyDelegationToken(config *connectionConfig, values map[string]string) error {
	if !strings.EqualFold(config.Auth, "DELEGATIONTOKEN") && !strings.EqualFold(config.Auth, "DELEGATION_TOKEN") {
		return nil
	}
	token := firstNonEmpty(parameter(values, "delegationtoken"), parameter(values, "token"), config.Password)
	if token == "" {
		return errors.New("Hive delegation token authentication requires delegationToken, token, or password")
	}
	config.DelegationToken = token
	identifier, password, err := decodeHadoopDelegationToken(token)
	if err != nil {
		return fmt.Errorf("decode Hive delegation token: %w", err)
	}
	config.Username = base64.StdEncoding.EncodeToString(identifier)
	config.Password = base64.StdEncoding.EncodeToString(password)
	return nil
}

func decodeHadoopDelegationToken(value string) ([]byte, []byte, error) {
	encoded := strings.Join(strings.Fields(strings.TrimSpace(value)), "")
	if encoded == "" {
		return nil, nil, errors.New("token is empty")
	}
	var decoded []byte
	var decodeErr error

View on GitHub (pinned to c0390bff16)

Solutions

Set the delegationToken parameter (or the alias token) to the encoded Hadoop delegation token string.
As a fallback, set the password property to the token string — the driver accepts it as the token source.
Ensure the token acquisition step (e.g. from MetaStore or WebHDFS doAs endpoint) actually returned a non-empty token before connecting.
If you did not intend delegation-token auth, change auth to the intended mechanism.

Example fix

// before
params := map[string]string{"auth": "DELEGATIONTOKEN"}
// after
params := map[string]string{"auth": "DELEGATIONTOKEN", "delegationToken": tokenString}

Defensive patterns

Strategy: validation

Validate before calling

func requireDelegationToken(params map[string]string) error {
    if strings.EqualFold(params["auth"], "DELEGATIONTOKEN") || strings.EqualFold(params["auth"], "DELEGATION_TOKEN") {
        if params["delegationToken"] == "" && params["token"] == "" && params["password"] == "" {
            return errors.New("delegation-token auth needs delegationToken, token, or password")
        }
    }
    return nil
}

Prevention

Set delegationToken explicitly rather than relying on password fallback
Acquire and validate the token before opening the connection
Keep token acquisition and connection setup in the same deployment step

When it happens

Trigger: Setting auth=DELEGATIONTOKEN without supplying delegationToken/token params or a password; fetching the token from an external service that failed silently and returned an empty string; passing the credential under a custom key the driver ignores.

Common situations: Kerberos setups where the delegation token is generated at runtime but injection into the DSN failed, switching from password auth to delegation-token auth while clearing the password, CI pipelines where the token secret wasn't provided.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/e41e11258ad20f62. Report an issue: GitHub.