diff --git a/hadoop-hdfs-project/hadoop-hdfs-client/src/main/java/org/apache/hadoop/hdfs/protocol/datatransfer/sasl/SaslParticipant.java b/hadoop-hdfs-project/hadoop-hdfs-client/src/main/java/org/apache/hadoop/hdfs/protocol/datatransfer/sasl/SaslParticipant.java
index 7fb2f9f5fe94a..85edcc6a0c5ae 100644
--- a/hadoop-hdfs-project/hadoop-hdfs-client/src/main/java/org/apache/hadoop/hdfs/protocol/datatransfer/sasl/SaslParticipant.java
+++ b/hadoop-hdfs-project/hadoop-hdfs-client/src/main/java/org/apache/hadoop/hdfs/protocol/datatransfer/sasl/SaslParticipant.java
@@ -127,8 +127,13 @@ private SaslParticipant(SaslClient saslClient) {
   }
 
   byte[] createFirstMessage() throws SaslException {
-    return SaslMechanismFactory.isDefaultMechanism(MECHANISM_ARRAY[0]) ? EMPTY_BYTE_ARRAY
-        : evaluateChallengeOrResponse(EMPTY_BYTE_ARRAY);
+    if (saslClient != null) {
+      return saslClient.hasInitialResponse()
+          ? saslClient.evaluateChallenge(EMPTY_BYTE_ARRAY)
+          : EMPTY_BYTE_ARRAY;
+    }
+    throw new IllegalStateException(
+        "createFirstMessage must only be called for clients");
   }
 
   /**