apache/hadoop · error · AccessControlException

Cannot get the remote user name

Error message

Cannot get the remote user name

What it means

RouterPermissionChecker.checkSuperuserPrivilege first tries NameNode.getRemoteUser() to obtain the UGI of the current RPC caller. If that returns null (or throws and leaves ugi null) - meaning there is no remote user attached to this call context - the router logs the error and throws this AccessControlException: superuser checks cannot proceed without an authenticated caller.

Source

Thrown at hadoop-hdfs-project/hadoop-hdfs-rbf/src/main/java/org/apache/hadoop/hdfs/server/federation/router/RouterPermissionChecker.java:118

  /**
   * Check the superuser privileges of the current RPC caller. This method is
   * based on Datanode#checkSuperuserPrivilege().
   * @throws AccessControlException If the user is not authorized.
   */
  @Override
  public void checkSuperuserPrivilege() throws  AccessControlException {

    // Try to get the ugi in the RPC call.
    UserGroupInformation ugi = null;
    try {
      ugi = NameNode.getRemoteUser();
    } catch (IOException e) {
      // Ignore as we catch it afterwards
    }
    if (ugi == null) {
      LOG.error("Cannot get the remote user name");
      throw new AccessControlException("Cannot get the remote user name");
    }

    // Is this by the Router user itself?
    if (ugi.getShortUserName().equals(superUser)) {
      return;
    }

    // Is the user a member of the super group?
    if (ugi.getGroupsSet().contains(superGroup)) {
      return;
    }

    // Not a superuser
    throw new AccessControlException(
        ugi.getUserName() + " is not a super user");
  }
}

View on GitHub (pinned to 2add963021)

Solutions

1. Invoke the router protocol over a real RPC connection (router:// or the router's RPC address) so a remote UGI exists
2. In tests, wrap the call in UserGroupInformation.createUserForTesting and run it through an RPC server, or use a client handle obtained from a started service
3. Ensure the call runs on the RPC handler thread; do not invoke protocol methods from lifecycle/other threads directly

Example fix

// before: direct in-process call, no RPC context
routerAdminServer.addMountTable(entry);   // AccessControlException: Cannot get the remote user name
// after: call through the RPC client
UserGroupInformation ugi = UserGroupInformation.createUserForTesting("hdfs", new String[]{"supergroup"});
ugi.doAs((PrivilegedExceptionAction<Void>) () -> {
  try (RouterClient client = new RouterClientFactory().createRouterAdminClient(conf, routerAdminAddress)) {
    client.getMountTableAdmin().addMountTable(entry); 
  }
  return null;
});

// Ensure an RPC caller exists before invoking superuser-gated protocol methods
UserGroupInformation caller = null;
try { caller = NameNode.getRemoteUser(); } catch (IOException ignored) { }
if (caller == null) {
  throw new IllegalStateException("No RPC context: invoke the router protocol over RPC, not in-process");
}

boolean hasRemoteRpcCaller() {
  try { return NameNode.getRemoteUser() != null; } catch (IOException e) { return false; }
}

try {
  protocol.checkSuperuserPrivilege(); // or the admin call that triggers it
} catch (AccessControlException ace) {
  if ("Cannot get the remote user name".equals(ace.getMessage())) {
    // reissue over a real RPC connection as an authenticated user
  }
  throw ace;
}

When it happens

Trigger: checkSuperuserPrivilege is executed outside a real RPC context, e.g. an in-process/embedded call into the admin or client protocol with no Server.getCurrent RPC attached, or a code path invoked during service lifecycle where getRemoteUser finds no call.

Common situations: Unit tests or embedded routers invoking protocol methods directly; custom tooling calling router methods locally instead of over RPC; rare degenerate calls during router startup/shutdown where the handler runs off the RPC thread.

Related errors

• {} is not a super user
• Permission denied rename {}({}) to {}({}) Reason={}
• Permission denied while accessing mount table {}: user {} do
• No mount point for %s
• Rename of {} to {} is not allowed, no eligible destination i

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/d6d560b92d89cf39. Report an issue: GitHub.