apache/hadoop · error · ServiceStateException

No user for ACLs determinable from current user or registry

Error message

No user for ACLs determinable from current user or registry option hadoop.registry.user.accounts

What it means

In digest mode RegistrySecurity builds the user ACL list from an optional self-ACL derived from the current UGI user plus the comma-separated hadoop.registry.user.accounts option. If that list ends up empty, no principal would be granted rights on created nodes — the nodes could become inaccessible — so initSecurity throws ServiceStateException with E_NO_USER_DETERMINED_FOR_ACLS ('No user for ACLs determinable from current user or registry option hadoop.registry.user.accounts').

Source

Thrown at hadoop-common-project/hadoop-registry/src/main/java/org/apache/hadoop/registry/client/impl/zk/RegistrySecurity.java:291

            throw new IOException("Kerberos required for secure registry access");
          }
          UserGroupInformation currentUser =
              UserGroupInformation.getCurrentUser();
          jaasClientEntry = getOrFail(KEY_REGISTRY_CLIENT_JAAS_CONTEXT,
              DEFAULT_REGISTRY_CLIENT_JAAS_CONTEXT);
          jaasClientIdentity = currentUser.getShortUserName();
          if (LOG.isDebugEnabled()) {
            LOG.debug("Auth is SASL user=\"{}\" JAAS context=\"{}\"",
                jaasClientIdentity, jaasClientEntry);
          }
          break;

        case digest:
          String id = getOrFail(KEY_REGISTRY_CLIENT_AUTHENTICATION_ID, "");
          String pass = getOrFail(KEY_REGISTRY_CLIENT_AUTHENTICATION_PASSWORD, "");
          if (userACLs.isEmpty()) {
            //
            throw new ServiceStateException(E_NO_USER_DETERMINED_FOR_ACLS);
          }
          digest(id, pass);
          ACL acl = new ACL(ZooDefs.Perms.ALL, toDigestId(id, pass));
          userACLs.add(acl);
          digestAuthUser = id;
          digestAuthPassword = pass;
          String authPair = id + ":" + pass;
          digestAuthData = authPair.getBytes(StandardCharsets.UTF_8);
          if (LOG.isDebugEnabled()) {
            LOG.debug("Auth is Digest ACL: {}", aclToString(acl));
          }
          break;

        case anon:
        case simple:
          // nothing is needed; account is read only.
          if (LOG.isDebugEnabled()) {
            LOG.debug("Auth is anonymous");

View on GitHub (pinned to 2add963021)

Solutions

Set hadoop.registry.user.accounts to the account names that should receive ACL entries (e.g. 'registry,alice').
Verify via RegistryOperationsFactory.createAuthenticatedInstance(id, password, ...) plus explicit user accounts in the configuration.
If Kerberos infrastructure exists, prefer client.auth=kerberos where the self-ACL is derived from the logged-in user automatically.

Example fix

// before
conf.set("hadoop.registry.client.auth", "digest");
conf.set("hadoop.registry.client.auth.id", "registry");
conf.set("hadoop.registry.client.auth.password", "secret");
// hadoop.registry.user.accounts unset -> E_NO_USER_DETERMINED_FOR_ACLS

// after
conf.set("hadoop.registry.user.accounts", "registry,alice");

Defensive patterns

Strategy: validation

Validate before calling

if ("digest".equals(conf.get("hadoop.registry.client.auth", ""))
    && StringUtils.isEmpty(conf.get("hadoop.registry.user.accounts", ""))) {
  conf.set("hadoop.registry.user.accounts", System.getProperty("user.name"));
  // or fail fast with a clear message naming hadoop.registry.user.accounts
}

Try / catch

try {
  RegistryOperations ops = RegistryOperationsFactory.createAuthenticatedInstance(conf, id, pass, null);
} catch (ServiceStateException e) {
  // E_NO_USER_DETERMINED_FOR_ACLS: set hadoop.registry.user.accounts and retry
}

Prevention

When configuring digest auth, always set hadoop.registry.user.accounts alongside auth.id/auth.password.
Prefer kerberos auth where a self-ACL is derived from the logged-in user automatically.
Add a config checklist item for digest setups: id, password, and user accounts must all be present.

When it happens

Trigger: client.auth=digest with hadoop.registry.user.accounts unset or empty and createSaslACLFromCurrentUser returning null (no derivable user), i.e. only id/password configured but no accounts to own the created nodes.

Common situations: Digest-auth setups where only auth.id/auth.password were configured and the accounts option was forgotten; running under a UGI whose short username cannot be determined; minimal test configs copied from docs.

Related errors

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/3e457ebf44745f7a. Report an issue: GitHub.