What causes "Group {} can not be removed" in apache/hadoop?

Skip wildcard tokens before calling removeGroup

apache/hadoop · error · IllegalArgumentException

Group can not be removed

Error message

Group {} can not be removed

What it means

AccessControlList.removeGroup throws IllegalArgumentException when the group name is a wildcard ACL value ("*"). Same rule as the other mutators: wildcard is an ACL-level construct, not a removable entry, so removeGroup rejects it.

Solutions

Skip wildcard tokens before calling removeGroup
Rebuild the ACL from a corrected string instead of mutating a wildcard ACL
Add a shared guard (isWildCardACLValue-style check) around all ACL mutation call sites

Example fix

// before
for (String g : removedGroups) {
  acl.removeGroup(g); // throws if g == "*"
}

// after
for (String g : removedGroups) {
  if (!"*".equals(g.trim())) {
    acl.removeGroup(g.trim());
  }
}

Defensive patterns

Strategy: validation

Validate before calling

private static boolean isWildCardAclToken(String s) {
  return s == null || s.trim().isEmpty() || "*".equals(s.trim());
}

for (String g : removed) {
  if (!isWildCardAclToken(g)) {
    acl.removeGroup(g.trim());
  }
}

Try / catch

try {
  acl.removeGroup(group);
} catch (IllegalArgumentException e) {
  throw new ConfigException("Wildcard group token not allowed: " + group, e);
}

Prevention

Filter tokens before removal loops
Prefer immutable ACL reconstruction over incremental mutation of policy-driven ACLs
Test remove paths with wildcard fixtures

When it happens

Trigger: Calling removeGroup("*"); diff-driven group removal code that walks tokens from an ACL string; cleanup paths after addGroup-based construction.

Common situations: Tools that keep AccessControlList objects in sync with policy files; removing groups from ACLs that were built from wildcard strings.

Related errors

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/a2342a96d05e7d83. Report an issue: GitHub.

Appendix: source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/authorize/AccessControlList.java:202

   */
  public void removeUser(String user) {
    if (isWildCardACLValue(user)) {
      throw new IllegalArgumentException("User " + user + " can not be removed");
    }
    if (!isAllAllowed()) {
      users.remove(user);
    }
  }

  /**
   * Remove group from the names of groups allowed for this service.
   * 
   * @param group
   *          The group name
   */
  public void removeGroup(String group) {
    if (isWildCardACLValue(group)) {
      throw new IllegalArgumentException("Group " + group
          + " can not be removed");
    }
    if (!isAllAllowed()) {
      groups.remove(group);
    }
  }

  /**
   * Get the names of users allowed for this service.
   * @return the set of user names. the set must not be modified.
   */
  public Collection<String> getUsers() {
    return users;
  }
  
  /**
   * Get the names of user groups allowed for this service.
   * @return the set of group names. the set must not be modified.

View on GitHub (pinned to 2add963021)