NationalSecurityAgency/ghidra · error · IOException

Error creating new user

Error message

Error creating new user

What it means

Thrown by reloadIdent() when `pg_ctl reload -s` returns non-zero after BSim patches pg_ident.conf. The reload tells PostgreSQL to re-read its identity map; failure means the new certificate-to-user mapping was not picked up.

Source

Thrown at Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/BSimControlLaunchable.java:1109

		}
	}

	/**
	 * Trigger a server running on the local host to rescan its identity file to pickup
	 * any changes to the user mapping
	 * @throws IOException if creating a new user fails
	 * @throws InterruptedException if the reload command is interrupted
	 */
	private void reloadIdent() throws IOException, InterruptedException {
		List<String> command = new ArrayList<String>();
		command.add(postgresControl.getAbsolutePath());
		command.add("reload");
		command.add("-D");
		command.add(dataDirectory.getAbsolutePath());
		command.add("-s");
		int res = runCommand(null, command, loadLibraryVar, loadLibraryValue);
		if (res != 0) {
			throw new IOException("Error creating new user");
		}
	}

	/**
	 * Update the PostgreSQL identity map (pg_ident.conf) adding a map from
	 * the currently active -commonName- to -username-
	 * @param username the user name to add
	 * @throws IOException if the postgres ident file is invalid
	 */
	private void addCertificateName(String username) throws IOException {
		File identFile = new File(dataDirectory, POSTGRES_IDENTFILE);
		File copyFile = new File(dataDirectory, POSTGRES_IDENTFILE + ".copy");
		if (!identFile.isFile()) {
			throw new IOException("Missing ident file: " + identFile.getAbsolutePath());
		}
		ServerConfig.patchIdent(identFile, copyFile, POSTGRES_MAP_IDENTIFIER, commonName, username,
			true);
		FileUtilities.copyFile(copyFile, identFile, false, null);

View on GitHub (pinned to d5f144c24d)

Solutions

1. Ensure the server is running before adding/dropping users: `bsim_ctl status`.
2. Inspect pg_ident.conf for syntax errors introduced by patchIdent.
3. Run bsim_ctl as the data-directory owner.
4. Retry the adduser/dropuser once the server is confirmed up.

// Ensure server is up before a user op that triggers reloadIdent.
int rc = runPgCtl("status", dataDir);
if (rc != 0) {
    throw new IllegalStateException("Server not running; cannot reload pg_ident.conf");
}

public boolean identFilePatchable(File dir) {
    File f = new File(dir, "pg_ident.conf");
    return f.isFile() && f.canRead() && f.canWrite();
}

try {
    bsimControl.adduser(args);
} catch (IOException e) {
    if ("Error creating new user".equals(e.getMessage())) {
        throw new UserFacingException("pg_ctl reload failed; is the server running and pg_ident.conf valid?", e);
    }
    throw e;
}

When it happens

Trigger: During addCertificateName (init flow) or the drop-user ident patch, after editing pg_ident.conf, `pg_ctl reload -D <dataDir> -s` exits non-zero.

Common situations: Server not running when reload is attempted; malformed pg_ident.conf edit; permissions on the data directory; postgres process owned by a different user.

Related errors

• PKI authentication requested, but certificate authority file
• Distinguished name option (--dn) required for {}
• Missing ident file: {}
• {} is not a valid certification authority
• File {} does not appear to be a certificate

AI-assisted analysis of NationalSecurityAgency/ghidra@d5f144c24d (2026-08-14). Data as JSON: /api/errors/5be96ffb71135ff6. Report an issue: GitHub.