apache/hadoop · error · IllegalArgumentException

ACL '{}' not of expected form scheme:id

Error message

ACL '{}' not of expected form scheme:id

What it means

RegistrySecurity.parse(idPair, realm) converts a string into a ZooKeeper Id of the form scheme:id; the string must contain exactly one colon (firstColon == lastColon). No colon at all, or more than one colon, throws IllegalArgumentException("ACL '<idPair>' not of expected form scheme:id"). An id ending in '@' is additionally legal only when a realm is supplied, to which it is appended.

Source

Thrown at hadoop-common-project/hadoop-registry/src/main/java/org/apache/hadoop/registry/client/impl/zk/RegistrySecurity.java:552

      if (next.startsWith(SCHEME_SASL +":") && next.endsWith("@")) {
        listIterator.set(next + realm);
      }
    }
    return list;
  }

  /**
   * Parse a string down to an ID, adding a realm if needed
   * @param idPair id:data tuple
   * @param realm realm to add
   * @return the ID.
   * @throws IllegalArgumentException if the idPair is invalid
   */
  public Id parse(String idPair, String realm) {
    int firstColon = idPair.indexOf(':');
    int lastColon = idPair.lastIndexOf(':');
    if (firstColon == -1 || lastColon == -1 || firstColon != lastColon) {
      throw new IllegalArgumentException(
          "ACL '" + idPair + "' not of expected form scheme:id");
    }
    String scheme = idPair.substring(0, firstColon);
    String id = idPair.substring(firstColon + 1);
    if (id.endsWith("@")) {
      Preconditions.checkArgument(
          StringUtils.isNotEmpty(realm),
          "@ suffixed account but no realm %s", id);
      id = id + realm;
    }
    return new Id(scheme, id);
  }

  /**
   * Parse the IDs, adding a realm if needed, setting the permissions
   * @param principalList id string
   * @param realm realm to add
   * @param perms permissions

View on GitHub (pinned to 2add963021)

Solutions

1. Fix each entry to scheme:id form, e.g. 'sasl:alice' (optionally 'sasl:alice@' so the configured realm is appended).
2. Keep exactly one colon per entry; put realms after '@', not as extra colon-separated fields.
3. Validate entries against a ^[^:]+:[^:]+$ pattern before passing them to registry security APIs.

Example fix

// before
registrySecurity.parse("digest:alice:extra", "REALM"); // two colons -> IllegalArgumentException

// after
registrySecurity.parse("digest:alice", "REALM"); // exactly one colon: scheme:id

private static final Pattern SCHEME_ID = Pattern.compile("^[^:]+:[^:]+$");

for (String entry : entries) {
  if (!SCHEME_ID.matcher(entry).matches()) {
    throw new IllegalArgumentException(
        "ACL '" + entry + "' not of expected form scheme:id");
  }
}
// entries are now safe for RegistrySecurity.parse(entry, realm)

try {
  Id id = registrySecurity.parse(idPair, realm);
} catch (IllegalArgumentException e) {
  // message shows the malformed pair: rewrite as scheme:id with exactly one colon
}

When it happens

Trigger: ACL/principal-list parsing encountering entries like 'sasl' (no colon) or 'digest:user:extra' (two colons); passing a bare username or a full Kerberos principal where 'scheme:id' was expected.

Common situations: Editing hadoop.registry.user.accounts or principal-list configuration and omitting the scheme prefix; copy-paste of 'user@REALM' strings into a scheme:id field; hand-built ACL strings in custom registry tooling.

Related errors

• Parsing {} :{}
• No user for ACLs determinable from current user or registry
• Empty ACL list
• Unknown/unsupported authentication mechanism; "{}"
• Kerberos required for secure registry access

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/1b0e9800bebf4abe. Report an issue: GitHub.