apache/hadoop · error · IllegalArgumentException

Group {} can not be removed

Error message

Group {} can not be removed

What it means

AccessControlList.removeGroup throws IllegalArgumentException when the group name is a wildcard ACL value ("*"). Same rule as the other mutators: wildcard is an ACL-level construct, not a removable entry, so removeGroup rejects it.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/authorize/AccessControlList.java:202

   */
  public void removeUser(String user) {
    if (isWildCardACLValue(user)) {
      throw new IllegalArgumentException("User " + user + " can not be removed");
    }
    if (!isAllAllowed()) {
      users.remove(user);
    }
  }

  /**
   * Remove group from the names of groups allowed for this service.
   * 
   * @param group
   *          The group name
   */
  public void removeGroup(String group) {
    if (isWildCardACLValue(group)) {
      throw new IllegalArgumentException("Group " + group
          + " can not be removed");
    }
    if (!isAllAllowed()) {
      groups.remove(group);
    }
  }

  /**
   * Get the names of users allowed for this service.
   * @return the set of user names. the set must not be modified.
   */
  public Collection<String> getUsers() {
    return users;
  }
  
  /**
   * Get the names of user groups allowed for this service.
   * @return the set of group names. the set must not be modified.

View on GitHub (pinned to 2add963021)

Solutions

  1. Skip wildcard tokens before calling removeGroup
  2. Rebuild the ACL from a corrected string instead of mutating a wildcard ACL
  3. Add a shared guard (isWildCardACLValue-style check) around all ACL mutation call sites

Example fix

// before
for (String g : removedGroups) {
  acl.removeGroup(g); // throws if g == "*"
}

// after
for (String g : removedGroups) {
  if (!"*".equals(g.trim())) {
    acl.removeGroup(g.trim());
  }
}
Defensive patterns

Strategy: validation

Validate before calling

private static boolean isWildCardAclToken(String s) {
  return s == null || s.trim().isEmpty() || "*".equals(s.trim());
}

for (String g : removed) {
  if (!isWildCardAclToken(g)) {
    acl.removeGroup(g.trim());
  }
}

Try / catch

try {
  acl.removeGroup(group);
} catch (IllegalArgumentException e) {
  throw new ConfigException("Wildcard group token not allowed: " + group, e);
}

Prevention

When it happens

Trigger: Calling removeGroup("*"); diff-driven group removal code that walks tokens from an ACL string; cleanup paths after addGroup-based construction.

Common situations: Tools that keep AccessControlList objects in sync with policy files; removing groups from ACLs that were built from wildcard strings.

Related errors

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/a2342a96d05e7d83. Report an issue: GitHub.