What causes "Group {} can not be added" in apache/hadoop?

Filter wildcard tokens before calling addGroup (token.equals("*"))

apache/hadoop · error · IllegalArgumentException

Group {} can not be added

Error message

Group {} can not be added

What it means

AccessControlList.addGroup throws IllegalArgumentException when the group name is a wildcard ACL value ("*"). As with users, a wildcard cannot be a single group entry; it is only valid as a whole-ACL string. addGroup also caches the group via groupsMapping.cacheGroupsAdd, which a wildcard would corrupt.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/authorize/AccessControlList.java:169

   */
  public void addUser(String user) {
    if (isWildCardACLValue(user)) {
      throw new IllegalArgumentException("User " + user + " can not be added");
    }
    if (!isAllAllowed()) {
      users.add(user);
    }
  }

  /**
   * Add group to the names of groups allowed for this service.
   * 
   * @param group
   *          The group name
   */
  public void addGroup(String group) {
    if (isWildCardACLValue(group)) {
      throw new IllegalArgumentException("Group " + group + " can not be added");
    }
    if (!isAllAllowed()) {
      List<String> groupsList = new LinkedList<String>();
      groupsList.add(group);
      groupsMapping.cacheGroupsAdd(groupsList);
      groups.add(group);
    }
  }

  /**
   * Remove user from the names of users allowed for this service.
   * 
   * @param user
   *          The user name
   */
  public void removeUser(String user) {
    if (isWildCardACLValue(user)) {
      throw new IllegalArgumentException("User " + user + " can not be removed");

View on GitHub (pinned to 2add963021)

Solutions

Filter wildcard tokens before calling addGroup (token.equals("*"))
Construct wildcard ACLs directly: new AccessControlList("*")
Reject wildcard entries in upstream validation of group lists

Example fix

// before
for (String g : groupsFromConfig) {
  acl.addGroup(g); // throws if g == "*"
}

// after
for (String g : groupsFromConfig) {
  if (!"*".equals(g.trim())) {
    acl.addGroup(g.trim());
  }
}

Defensive patterns

Strategy: validation

Validate before calling

private static boolean isWildCardAclToken(String s) {
  return s == null || s.trim().isEmpty() || "*".equals(s.trim());
}

for (String g : tokens) {
  if (!isWildCardAclToken(g)) {
    acl.addGroup(g.trim());
  }
}

Try / catch

try {
  acl.addGroup(group);
} catch (IllegalArgumentException e) {
  throw new ConfigException("Wildcard group token not allowed: " + group, e);
}

Prevention

Parse complete ACL strings with the AccessControlList constructor instead of token-by-token mutation
Reject wildcard group tokens during config validation
Unit-test ACL builders with "*" inputs to fail fast at build time

When it happens

Trigger: Calling addGroup("*"); splitting an ACL string such as "* " and routing the wildcard token into addGroup; reusing parsers that pass through "*" from configuration.

Common situations: Programmatic ACL assembly from config fragments; tools that mirror service ACLs into AccessControlList objects; tests using wildcard fixtures.

Related errors

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/8e178df5287ef7d3. Report an issue: GitHub.