apache/hadoop · error · IllegalArgumentException

Null real user

Error message

Null real user

What it means

UGI.createProxyUser requires a non-null real (authenticating) user to attach as RealUser principal; null is rejected with IllegalArgumentException('Null real user'). A proxy identity is meaningless without the identity it is derived from.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/UserGroupInformation.java:1529

    }
  };

  /**
   * Create a proxy user using username of the effective user and the ugi of the
   * real user.
   * @param user user.
   * @param realUser realUser.
   * @return proxyUser ugi
   */
  @InterfaceAudience.Public
  @InterfaceStability.Evolving
  public static UserGroupInformation createProxyUser(String user,
      UserGroupInformation realUser) {
    if (user == null || user.isEmpty()) {
      throw new IllegalArgumentException("Null user");
    }
    if (realUser == null) {
      throw new IllegalArgumentException("Null real user");
    }
    Subject subject = new Subject();
    Set<Principal> principals = subject.getPrincipals();
    principals.add(new User(user, AuthenticationMethod.PROXY, null));
    principals.add(new RealUser(realUser));
    return new UserGroupInformation(subject);
  }

  /**
   * get RealUser (vs. EffectiveUser)
   * @return realUser running over proxy user
   */
  @InterfaceAudience.Public
  @InterfaceStability.Evolving
  public UserGroupInformation getRealUser() {
    for (RealUser p: subject.getPrincipals(RealUser.class)) {
      return p.getRealUser();
    }

View on GitHub (pinned to 2add963021)

Solutions

1. Log in the real user first (loginUserFromKeytab/loginUserFromTicketCache/getLoginUser) and pass that UGI
2. Null-check the real user UGI and fail fast with a descriptive error naming the missing login step
3. Review call ordering in proxy pipelines so the authenticated UGI exists before proxying

Example fix

// before
UserGroupInformation proxy =
    UserGroupInformation.createProxyUser(proxyUser, realUser);
// after
Objects.requireNonNull(realUser, "real user must be logged in first");
UserGroupInformation proxy =
    UserGroupInformation.createProxyUser(proxyUser, realUser);

Objects.requireNonNull(realUser, "real user must be logged in first");
UserGroupInformation.createProxyUser(proxyUser, realUser);

static boolean isUsableRealUser(UserGroupInformation realUser) {
  return realUser != null && realUser.getUserName() != null;
}

When it happens

Trigger: createProxyUser(user, null) - the real user UGI was never logged in, a lookup returned null, or an optional-authentication path skipped login.

Common situations: Calling createProxyUser before the real user's login completed; static initialization ordering where realUser is assigned later; refactors dropping the login call.

Related errors

• Subject must not be null
• user is null.
• Failed to rename %s to %s, file already exists or not empty!
• source map cannot be null
• null component type not allowed

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/3c1361eef5d04549. Report an issue: GitHub.