t8y2/dbx · error

token identifier and password must be non-empty

Error message

token identifier and password must be non-empty

What it means

After decoding the base64 delegation token, the driver reads the Hadoop token's fields (identifier, password, kind, service). If the decoded identifier or password byte slice is empty, the token is malformed, so decodeHadoopDelegationToken returns this error — the token decodes but does not contain a valid identifier/password pair.

Source

Thrown at agents/drivers/argo-go/config.go:784

		decoded, decodeErr = encoding.DecodeString(encoded)
		if decodeErr == nil {
			break
		}
	}
	if decodeErr != nil {
		return nil, nil, decodeErr
	}
	reader := strings.NewReader(string(decoded))
	identifier, err := readHadoopByteArray(reader)
	if err != nil {
		return nil, nil, fmt.Errorf("identifier: %w", err)
	}
	password, err := readHadoopByteArray(reader)
	if err != nil {
		return nil, nil, fmt.Errorf("password: %w", err)
	}
	if len(identifier) == 0 || len(password) == 0 {
		return nil, nil, errors.New("token identifier and password must be non-empty")
	}
	if _, err := readHadoopByteArray(reader); err != nil {
		return nil, nil, fmt.Errorf("kind: %w", err)
	}
	if _, err := readHadoopByteArray(reader); err != nil {
		return nil, nil, fmt.Errorf("service: %w", err)
	}
	if reader.Len() != 0 {
		return nil, nil, errors.New("token contains trailing data")
	}
	return identifier, password, nil
}

func readHadoopByteArray(reader io.ByteReader) ([]byte, error) {
	length, err := readHadoopVInt(reader)
	if err != nil {
		return nil, err
	}

View on GitHub (pinned to c0390bff16)

Solutions

1. Re-fetch a fresh, complete delegation token from the Hadoop/HistoryServer (e.g. via kinit + hdfs fetchdt or the Hive thrift GetDelegationToken call)
2. Verify you are passing a Hadoop delegation token, not a JWT or other base64 blob
3. Check that the token was not truncated (correct length, no shell-mangled characters)

Example fix

// before
values["delegationToken"] = jwtString // wrong token type
// after
values["delegationToken"] = hadoopDelegationTokenBase64 // from GetDelegationToken

raw, err := base64.StdEncoding.DecodeString(token)
if err != nil || len(raw) < 8 {
    return errors.New("token too short to be a Hadoop delegation token")
}

identifier, password, err := decodeHadoopDelegationToken(token)
if err != nil {
    if strings.Contains(err.Error(), "must be non-empty") { /* refetch token */ }
    return err
}

When it happens

Trigger: Passing a base64 string that decodes successfully but whose binary structure yields a zero-length identifier or password — e.g. a truncated token, a token from the wrong cluster/version, or arbitrary base64 data.

Common situations: Token copied partially (truncated at paste); token issued by an incompatible Hadoop version; confusion between JWT strings and Hadoop delegation tokens (a JWT is valid base64 but not a Hadoop token).

Related errors

• Hive delegation token authentication requires delegationToke
• token is empty
• Hive host is required
• Hive connection string must start with jdbc:hive2:// or hive
• Hive endpoint is empty

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/35f00f833550e0bb. Report an issue: GitHub.