apache/hadoop · error · IOException

Invalid id:password

Error message

Invalid id:password

What it means

RegistrySecurity.digest(idPasswordPair) generates a ZooKeeper digest but first validates the pair: it must be non-empty and pass isValid(), which — stricter than ZooKeeper's own DigestAuthenticationProvider — requires both the id and the password halves to be non-empty around a single colon. Anything else (missing colon, empty id, empty password) throws IOException('Invalid id:password').

Source

Thrown at hadoop-common-project/hadoop-registry/src/main/java/org/apache/hadoop/registry/client/impl/zk/RegistrySecurity.java:468

  }

  /**
   * Get the derived kerberos realm.
   * @return this is built from the JVM realm, or the configuration if it
   * overrides it. If "", it means "don't know".
   */
  public String getKerberosRealm() {
    return kerberosRealm;
  }

  /**
   * Generate a base-64 encoded digest of the idPasswordPair pair
   * @param idPasswordPair id:password
   * @return a string that can be used for authentication
   */
  public String digest(String idPasswordPair) throws IOException {
    if (StringUtils.isEmpty(idPasswordPair) || !isValid(idPasswordPair)) {
      throw new IOException("Invalid id:password");
    }
    try {
      return DigestAuthenticationProvider.generateDigest(idPasswordPair);
    } catch (NoSuchAlgorithmException e) {
      // unlikely since it is standard to the JVM, but maybe JCE restrictions
      // could trigger it
      throw new IOException(e.toString(), e);
    }
  }

  /**
   * Generate a base-64 encoded digest of the idPasswordPair pair
   * @param id ID
   * @param password pass
   * @return a string that can be used for authentication
   * @throws IOException
   */
  public String digest(String id, String password) throws IOException {

View on GitHub (pinned to 2add963021)

Solutions

1. Set both the id and the password to non-empty values that contain no colons.
2. Validate the 'id:password' format (exactly one colon, both halves non-empty) before constructing the registry client.
3. Rotate the digest account credentials if the current password contains a colon.

Example fix

// before
registrySecurity.digest("registry:"); // empty password -> IOException("Invalid id:password")

// after
registrySecurity.digest("registry:secret"); // one colon, both halves non-empty

private static final Pattern ID_PASS = Pattern.compile("^[^:]+:[^:]+$");

void checkDigestPair(String id, String pass) {
  String pair = id + ":" + pass;
  if (!ID_PASS.matcher(pair).matches()) {
    throw new IllegalArgumentException("Invalid id:password (need non-empty id and pass, no colons)");
  }
}
// run before creating the digest-authenticated registry client

try {
  registrySecurity.digest(pair);
} catch (IOException e) {
  if ("Invalid id:password".equals(e.getMessage())) {
    // fix the id/password pair: both halves non-empty, exactly one colon
  }
}

When it happens

Trigger: digest("user:"), digest(":pass") or digest("no-colon"); in the built-in flow, initSecurity calls digest(id, pass) where either configured credential is empty; a password containing a colon also breaks the id:pass pairing.

Common situations: Setting only one of auth.id/auth.password; placeholder or blank credentials in config files; digest accounts whose generated password happens to contain ':' characters.

Related errors

• Invalid Path "%s" : %s
• Invalid Path element "%s"
• Address type of %s does not match required type of %s
• No addresses in endpoint
• Null endpoint

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/184cc98fcdac11dc. Report an issue: GitHub.