t8y2/dbx · error

identifier: %w

Error message

identifier: %w

What it means

This error means the identifier (owner) field of the Hadoop delegation token could not be read from the decoded token bytes. decodeHadoopDelegationToken reads length-prefixed byte arrays in order: identifier, password, kind, service; the first read failed, usually due to a truncated or corrupt token payload. The wrapping identifies which field failed during parsing.

Source

Thrown at agents/drivers/hive-go/config.go:780

	var decodeErr error
	for _, encoding := range []*base64.Encoding{
		base64.RawURLEncoding,
		base64.URLEncoding,
		base64.RawStdEncoding,
		base64.StdEncoding,
	} {
		decoded, decodeErr = encoding.DecodeString(encoded)
		if decodeErr == nil {
			break
		}
	}
	if decodeErr != nil {
		return nil, nil, decodeErr
	}
	reader := strings.NewReader(string(decoded))
	identifier, err := readHadoopByteArray(reader)
	if err != nil {
		return nil, nil, fmt.Errorf("identifier: %w", err)
	}
	password, err := readHadoopByteArray(reader)
	if err != nil {
		return nil, nil, fmt.Errorf("password: %w", err)
	}
	if len(identifier) == 0 || len(password) == 0 {
		return nil, nil, errors.New("token identifier and password must be non-empty")
	}
	if _, err := readHadoopByteArray(reader); err != nil {
		return nil, nil, fmt.Errorf("kind: %w", err)
	}
	if _, err := readHadoopByteArray(reader); err != nil {
		return nil, nil, fmt.Errorf("service: %w", err)
	}
	if reader.Len() != 0 {
		return nil, nil, errors.New("token contains trailing data")
	}
	return identifier, password, nil

View on GitHub (pinned to c0390bff16)

Solutions

1. Re-obtain an intact delegation token from the server and pass it verbatim
2. Check that the token string was not truncated or altered by shell quoting/line wrapping
3. Verify base64 decoding succeeded (no whitespace or invalid characters)

decoded, err := base64.StdEncoding.DecodeString(token)
// decoded must be long enough: >= 2 VInt + payload; check len(decoded) > 4 before use

if err != nil && strings.Contains(err.Error(), "identifier:") {
	return fmt.Errorf("token payload corrupt/truncated: %w", err)
}

When it happens

Trigger: Supplying a delegation token whose decoded bytes are shorter than the first length-prefixed field, or whose leading bytes are not a valid Hadoop VInt length.

Common situations: Token truncated by logging/clipboard; token encoded twice or half-decoded; Hadoop version producing a token layout variant the parser misreads.

Related errors

• token identifier and password must be non-empty
• token contains trailing data
• password: %w
• kind: %w
• service: %w

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/9b56f067060bdfb2. Report an issue: GitHub.