diff --git a/CHANGES.txt b/CHANGES.txt
index a4803618f2e..8e054c92f61 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -164,6 +164,9 @@ Trunk (unreleased changes)
     HADOOP-6579. Provide a mechanism for encoding/decoding Tokens from
     a url-safe string and change the commons-code library to 1.4. (omalley)
 
+    HADOOP-6596. Add a version field to the AbstractDelegationTokenIdentifier's
+    serialized value. (omalley)
+
   OPTIMIZATIONS
 
     HADOOP-6467. Improve the performance on HarFileSystem.listStatus(..).
diff --git a/src/java/org/apache/hadoop/security/token/delegation/AbstractDelegationTokenIdentifier.java b/src/java/org/apache/hadoop/security/token/delegation/AbstractDelegationTokenIdentifier.java
index bfb274bcddf..0fc4349c78e 100644
--- a/src/java/org/apache/hadoop/security/token/delegation/AbstractDelegationTokenIdentifier.java
+++ b/src/java/org/apache/hadoop/security/token/delegation/AbstractDelegationTokenIdentifier.java
@@ -34,6 +34,7 @@ import org.apache.hadoop.security.token.TokenIdentifier;
 @InterfaceAudience.LimitedPrivate({HDFS, MAPREDUCE})
 public abstract class AbstractDelegationTokenIdentifier 
 extends TokenIdentifier {
+  private static final byte VERSION = 0;
 
   private Text owner;
   private Text renewer;
@@ -145,6 +146,11 @@ extends TokenIdentifier {
   }
   
   public void readFields(DataInput in) throws IOException {
+    byte version = in.readByte();
+    if (version != VERSION) {
+	throw new IOException("Unknown version of delegation token " + 
+                              version);
+    }
     owner.readFields(in);
     renewer.readFields(in);
     realUser.readFields(in);
@@ -155,6 +161,7 @@ extends TokenIdentifier {
   }
 
   public void write(DataOutput out) throws IOException {
+    out.writeByte(VERSION);
     owner.write(out);
     renewer.write(out);
     realUser.write(out);