t8y2/dbx · error

token is empty

Error message

token is empty

What it means

decodeHadoopDelegationToken strips all whitespace from the input and, if nothing remains, rejects it with 'token is empty'. The token must then decode as base64 into a Hadoop Token protobuf. This fires after applyDelegationToken found some token source but it was effectively blank.

Source

Thrown at agents/drivers/hive-go/config.go:759

	}
	token := firstNonEmpty(parameter(values, "delegationtoken"), parameter(values, "token"), config.Password)
	if token == "" {
		return errors.New("Hive delegation token authentication requires delegationToken, token, or password")
	}
	config.DelegationToken = token
	identifier, password, err := decodeHadoopDelegationToken(token)
	if err != nil {
		return fmt.Errorf("decode Hive delegation token: %w", err)
	}
	config.Username = base64.StdEncoding.EncodeToString(identifier)
	config.Password = base64.StdEncoding.EncodeToString(password)
	return nil
}

func decodeHadoopDelegationToken(value string) ([]byte, []byte, error) {
	encoded := strings.Join(strings.Fields(strings.TrimSpace(value)), "")
	if encoded == "" {
		return nil, nil, errors.New("token is empty")
	}
	var decoded []byte
	var decodeErr error
	for _, encoding := range []*base64.Encoding{
		base64.RawURLEncoding,
		base64.URLEncoding,
		base64.RawStdEncoding,
		base64.StdEncoding,
	} {
		decoded, decodeErr = encoding.DecodeString(encoded)
		if decodeErr == nil {
			break
		}
	}
	if decodeErr != nil {
		return nil, nil, decodeErr
	}
	reader := strings.NewReader(string(decoded))

View on GitHub (pinned to c0390bff16)

Solutions

1. Provide the actual base64-encoded delegation token string.
2. Print/check the token length (without logging the token itself) before connecting to confirm it is non-empty.
3. Fix the upstream secret retrieval (env var name, vault path) that returned an empty value.

Example fix

// before
params["delegationToken"] = os.Getenv("HIVE_TOKEN") // env unset -> ""
// after
tok := os.Getenv("HIVE_TOKEN")
if tok == "" { return fmt.Errorf("HIVE_TOKEN is not set") }
params["delegationToken"] = tok

func ensureNonEmptyToken(v string) error {
    if strings.TrimSpace(v) == "" {
        return errors.New("delegation token is empty")
    }
    return nil
}

When it happens

Trigger: Passing delegationToken/token/password set to "", spaces, or only newlines; a template/config placeholder (like ${TOKEN}) resolved to empty; the token variable never assigned before decode is called.

Common situations: Secret managers returning empty values for missing keys, shell scripts where $(command) failed and emitted nothing, YAML/properties files with key present but value blank.

Related errors

• decode Hive delegation token: %w
• Hive delegation token authentication requires delegationToke
• token is empty
• Hive delegation token authentication requires delegationToke
• token identifier and password must be non-empty

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/df4e04f7a86bb0c9. Report an issue: GitHub.