t8y2/dbx · error

token identifier and password must be non-empty

Error message

token identifier and password must be non-empty

What it means

A Hadoop delegation token is a serialized structure of length-prefixed byte arrays: identifier, password, kind, service. After decoding base64 and reading identifier and password, the driver requires both to be non-empty; an empty either means the bytes are not a valid delegation token structure.

Source

Thrown at agents/drivers/hive-go/config.go:787

		decoded, decodeErr = encoding.DecodeString(encoded)
		if decodeErr == nil {
			break
		}
	}
	if decodeErr != nil {
		return nil, nil, decodeErr
	}
	reader := strings.NewReader(string(decoded))
	identifier, err := readHadoopByteArray(reader)
	if err != nil {
		return nil, nil, fmt.Errorf("identifier: %w", err)
	}
	password, err := readHadoopByteArray(reader)
	if err != nil {
		return nil, nil, fmt.Errorf("password: %w", err)
	}
	if len(identifier) == 0 || len(password) == 0 {
		return nil, nil, errors.New("token identifier and password must be non-empty")
	}
	if _, err := readHadoopByteArray(reader); err != nil {
		return nil, nil, fmt.Errorf("kind: %w", err)
	}
	if _, err := readHadoopByteArray(reader); err != nil {
		return nil, nil, fmt.Errorf("service: %w", err)
	}
	if reader.Len() != 0 {
		return nil, nil, errors.New("token contains trailing data")
	}
	return identifier, password, nil
}

func readHadoopByteArray(reader io.ByteReader) ([]byte, error) {
	length, err := readHadoopVInt(reader)
	if err != nil {
		return nil, err
	}

View on GitHub (pinned to c0390bff16)

Solutions

1. Regenerate the delegation token from the Hadoop service (e.g. via MetaStore getToken or kinit + hive token tooling) and use that exact base64 blob.
2. Verify you are not substituting a JWT or OAuth token for a Hadoop delegation token.
3. Check the token's serialization: it should decode into identifier/password/kind/service byte arrays; use a Hadoop utility to round-trip it if unsure.

Example fix

// before
params["delegationToken"] = idToken // wrong token type (JWT)
// after
params["delegationToken"] = hadoopDelegationToken // base64 of Hadoop Token identifier+password+kind+service

func looksLikeHadoopToken(b64 string) error {
    raw, err := base64.StdEncoding.DecodeString(strings.Join(strings.Fields(b64), ""))
    if err != nil || len(raw) < 4 {
        return fmt.Errorf("not a plausible hadoop token")
    }
    return nil
}

When it happens

Trigger: Passing a base64 string that decodes but is not a Hadoop token (e.g. an opaque JWT, an access token from another system, or arbitrary text base64-encoded); a truncated token whose length prefixes don't match; tokens from a different Hadoop version with a different serialization.

Common situations: Developers pasting a JWT where a Hadoop delegation token is expected, copying tokens between clusters/formats, tokens re-encoded with padding or line breaks that corrupted structure.

Related errors

• token contains trailing data
• Hive delegation token authentication requires delegationToke
• Hive delegation token authentication requires delegationToke
• token is empty
• decode Hive delegation token: %w

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/a02707e51c78b6e1. Report an issue: GitHub.