apache/hadoop · error · PartialGroupNameException

Does not support partial group name resolution on Windows. "

Error message

Does not support partial group name resolution on Windows. " + errMessage

What it means

ShellBasedUnixGroupsMapping.resolvePartialGroupNames supports recovering a partial group list when the initial lookup fails. On Windows (Shell.WINDOWS) the Unix-style partial-resolution fallback (a group-id shell helper) does not exist, so the partial failure is rethrown as PartialGroupNameException with the original shell error appended.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/ShellBasedUnixGroupsMapping.java:287

  }

  /**
   * Attempt to partially resolve group names.
   *
   * @param userName the user's name
   * @param errMessage error message from the shell command
   * @param groupNames the incomplete list of group names
   * @return a set of resolved group names
   * @throws PartialGroupNameException if the resolution fails or times out
   */
  private Set<String> resolvePartialGroupNames(String userName,
      String errMessage, String groupNames) throws PartialGroupNameException {
    // Exception may indicate that some group names are not resolvable.
    // Shell-based implementation should tolerate unresolvable groups names,
    // and return resolvable ones, similar to what JNI-based implementation
    // does.
    if (Shell.WINDOWS) {
      throw new PartialGroupNameException("Does not support partial group"
      + " name resolution on Windows. " + errMessage);
    }
    if (groupNames.isEmpty()) {
      throw new PartialGroupNameException("The user name '" + userName
          + "' is not found. " + errMessage);
    } else {
      LOG.warn("Some group names for '{}' are not resolvable. {}",
          userName, errMessage);
      // attempt to partially resolve group names
      ShellCommandExecutor partialResolver = createGroupIDExecutor(userName);
      try {
        partialResolver.execute();
        return parsePartialGroupNames(
            groupNames, partialResolver.getOutput());
      } catch (ExitCodeException ece) {
        // If exception is thrown trying to get group id list,
        // something is terribly wrong, so give up.
        throw new PartialGroupNameException(

View on GitHub (pinned to 2add963021)

Solutions

1. Identify the unresolvable group from the embedded error text and fix the user's membership in AD
2. Run the same lookup as the Hadoop service account on Windows to confirm it can enumerate all groups
3. Configure LdapGroupsMapping against AD so group resolution does not depend on shell behavior
4. As a workaround, remove the user from the stale/unresolvable group

try {
  groups = mapping.getGroups(user);
} catch (PartialGroupNameException e) {
  if (org.apache.hadoop.util.Shell.WINDOWS
      && e.getMessage().contains("Windows")) {
    // no partial resolution possible: fail over to another mapping backend or LdapGroupsMapping
  }
  throw e;
}

When it happens

Trigger: A Windows host performs group mapping for a user whose lookup partially failed (at least one unresolvable group), so the Linux-only partial resolution path cannot run and the mapping fails outright.

Common situations: Windows nodes in mixed clusters; AD groups deleted while still set as a user's primary group; the Hadoop service account lacking permission to read all group SIDs.

Understand the failure class

• DNS resolution errors: ENOTFOUND and getaddrinfo failures — how hostname lookups fail and how to debug them.

Related errors

• Number of group names and ids do not match. group name =" +
• Not implemented for Windows
• Error while running command to get file permissions : " + St
• Invalid path string ${pathString}
• Invalid path string

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/b1e5405ab54ac99b. Report an issue: GitHub.