Hive delegation token authentication requires delegationToke

Error message

Hive delegation token authentication requires delegationToken, token, or password

What it means

For DELEGATIONTOKEN / DELEGATION_TOKEN auth, the driver resolves the token from (in order) the delegationToken parameter, the token parameter, or the configured password. If all three are empty, applyDelegationToken returns this error because delegation-token authentication is impossible without a token.

Source

Thrown at agents/drivers/argo-go/config.go:741

	return key
}

func hiveAssignmentValue(values map[string]string, key string) string {
	for candidate, value := range values {
		if strings.EqualFold(strings.TrimSpace(candidate), key) {
			return value
		}
	}
	return ""
}

func applyDelegationToken(config *connectionConfig, values map[string]string) error {
	if !strings.EqualFold(config.Auth, "DELEGATIONTOKEN") && !strings.EqualFold(config.Auth, "DELEGATION_TOKEN") {
		return nil
	}
	token := firstNonEmpty(parameter(values, "delegationtoken"), parameter(values, "token"), config.Password)
	if token == "" {
		return errors.New("Hive delegation token authentication requires delegationToken, token, or password")
	}
	config.DelegationToken = token
	identifier, password, err := decodeHadoopDelegationToken(token)
	if err != nil {
		return fmt.Errorf("decode Hive delegation token: %w", err)
	}
	config.Username = base64.StdEncoding.EncodeToString(identifier)
	config.Password = base64.StdEncoding.EncodeToString(password)
	return nil
}

func decodeHadoopDelegationToken(value string) ([]byte, []byte, error) {
	encoded := strings.Join(strings.Fields(strings.TrimSpace(value)), "")
	if encoded == "" {
		return nil, nil, errors.New("token is empty")
	}
	var decoded []byte
	var decodeErr error

View on GitHub (pinned to c0390bff16)

Solutions

Pass delegationToken=<token> (or token=<token>) in the connection parameters
Set the token via the config Password field if that is how your setup supplies it
Use a different auth scheme if no delegation token is available

Example fix

// before
jdbc:hive2://host:10000/default?auth=DELEGATIONTOKEN
// after
jdbc:hive2://host:10000/default?auth=DELEGATIONTOKEN&delegationToken=<base64-token>

Defensive patterns

Strategy: validation

Validate before calling

if strings.EqualFold(auth, "DELEGATIONTOKEN") && delegationToken == "" && token == "" && password == "" {
    return errors.New("DELEGATIONTOKEN auth needs a token")
}

Try / catch

if err := applyDelegationToken(&cfg, values); err != nil {
    if strings.Contains(err.Error(), "requires delegationToken") { /* supply token */ }
    return err
}

Prevention

Pass the delegation token explicitly via delegationToken= or token=
Keep the password field reserved for real passwords to avoid confusion
Validate the auth scheme/credentials pair before connecting

When it happens

Trigger: Setting auth=DELEGATIONTOKEN (or DELEGATION_TOKEN) in parameters while leaving delegationToken, token, and password all unset.

Common situations: Switching auth to DELEGATIONTOKEN after a JWT/Kerberos setup without providing the token; the token env/parameter name typo'd; the password field cleared by a config refactor.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/2c805d1e5ee0c558. Report an issue: GitHub.