apache/hadoop · error · IllegalArgumentException

Malformed Kerberos name: ${name}

Error message

Malformed Kerberos name: ${name}

What it means

KerberosName parses a full principal as serviceName[/host]@REALM using a strict regex. When the string contains '@' but still fails to match the pattern, the constructor throws IllegalArgumentException('Malformed Kerberos name'), because an '@' implies a realm was intended and the shape must be legal.

Source

Thrown at hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/util/KerberosName.java:122

  @VisibleForTesting
  public static void resetDefaultRealm() {
    try {
      defaultRealm = KerberosUtil.getDefaultRealm();
    } catch (Exception ke) {
      LOG.debug("resetting default realm failed, "
          + "current default realm will still be used.", ke);
    }
  }

  /**
   * Create a name from the full Kerberos principal name.
   * @param name full Kerberos principal name.
   */
  public KerberosName(String name) {
    Matcher match = nameParser.matcher(name);
    if (!match.matches()) {
      if (name.contains("@")) {
        throw new IllegalArgumentException("Malformed Kerberos name: " + name);
      } else {
        serviceName = name;
        hostName = null;
        realm = null;
      }
    } else {
      serviceName = match.group(1);
      hostName = match.group(3);
      realm = match.group(5);
    }
  }

  /**
   * Get the configured default realm.
   * Used syncronized method here, because double-check locking is overhead.
   * @return the default realm from the krb5.conf
   */
  public static synchronized String getDefaultRealm() {

View on GitHub (pinned to 2add963021)

Solutions

1. Inspect the offending name and fix the producer so it emits a single 'service[/host]@REALM' form
2. Guard call sites with a format check for at most one '@' and '/' placement before constructing KerberosName
3. Where legacy names are legitimate, rely on auth_to_local RULEs instead of feeding malformed strings to KerberosName

Example fix

// before
KerberosName kn = new KerberosName(userName + "@" + realm + "@" + extra);

// after: exactly one realm, correctly placed
KerberosName kn = new KerberosName(userName + "@" + realm);

private static final java.util.regex.Pattern PRINCIPAL =
    java.util.regex.Pattern.compile("([^/@]+)(/([^/@]+))?(@([^/@]+))?");
boolean isPlausiblePrincipal(String name) {
  return name != null && !name.contains("@@") && PRINCIPAL.matcher(name).matches();
}

try { new KerberosName(name); } catch (IllegalArgumentException e) { /* reject login, log name, never fall back to raw string as identity */ }

When it happens

Trigger: new KerberosName(name) / HadoopKerberosName translation with strings like 'alice@REALM@EXTRA' (two '@'), '@REALM' (empty service), 'alice/bob@R@S', or embedded whitespace or escaped separators in wrong positions.

Common situations: Email-style usernames passed where a Kerberos principal is expected; principals built by concatenating user + '@' + realm with a null/empty user; unusual KDC escapes or DN fragments reaching auth_to_local translation.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• Invalid SPNEGO sequence, 'WWW-Authenticate' header incorrect
• Invalid SPNEGO sequence, status code: {}
• oidName: ${oidName} is not supported.
• NULL or empty string to sign
• Kerberos principal name does NOT have the expected hostname

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/27d67b723cc7f045. Report an issue: GitHub.