apache/hadoop · error · PartialGroupNameException

Number of group names and ids do not match. group name =" +

Error message

Number of group names and ids do not match. group name =" + groupNames + ", group id = " + groupIDs

What it means

When some of a user's groups fail to resolve, ShellBasedUnixGroupsMapping.parsePartialGroupNames tokenizes the group names already obtained and the ids from an 'id -G'-style command, walking both tokenizers in lockstep. If there are more name tokens than id tokens, the lists cannot be aligned and PartialGroupNameException is thrown showing both raw lists.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/ShellBasedUnixGroupsMapping.java:252

   * Attempt to parse group names given that some names are not resolvable.
   * Use the group id list to identify those that are not resolved.
   *
   * @param groupNames a string representing a list of group names
   * @param groupIDs a string representing a list of group ids
   * @return a linked list of group names
   * @throws PartialGroupNameException
   */
  private Set<String> parsePartialGroupNames(String groupNames,
      String groupIDs) throws PartialGroupNameException {
    StringTokenizer nameTokenizer =
        new StringTokenizer(groupNames, Shell.TOKEN_SEPARATOR_REGEX);
    StringTokenizer idTokenizer =
        new StringTokenizer(groupIDs, Shell.TOKEN_SEPARATOR_REGEX);
    Set<String> groups = new LinkedHashSet<>();
    while (nameTokenizer.hasMoreTokens()) {
      // check for unresolvable group names.
      if (!idTokenizer.hasMoreTokens()) {
        throw new PartialGroupNameException("Number of group names and ids do"
        + " not match. group name =" + groupNames + ", group id = " + groupIDs);
      }
      String groupName = nameTokenizer.nextToken();
      String groupID = idTokenizer.nextToken();
      if (!StringUtils.isNumeric(groupName) ||
          !groupName.equals(groupID)) {
        // if the group name is non-numeric, it is resolved.
        // if the group name is numeric, but is not the same as group id,
        // regard it as a group name.
        // if unfortunately, some group names are not resolvable, and
        // the group name is the same as the group id, regard it as not
        // resolved.
        groups.add(groupName);
      }
    }
    return groups;
  }

View on GitHub (pinned to 2add963021)

Solutions

1. On the mapping host run 'id <user>' and 'id -G <user>' and compare the counts
2. Fix inconsistency in the directory/NSS backend so both views agree
3. Raise hadoop.security.group.mapping.shell.command.timeout if truncation or timeouts are suspected
4. Switch to LdapGroupsMapping for direct LDAP group resolution to avoid shell semantics

try {
  List<String> groups = groups.getGroups(user);
} catch (PartialGroupNameException e) {
  if (e.getMessage().contains("do not match")) {
    // re-run 'id user' vs 'id -G user' on the mapping host; flag NSS inconsistency
  }
  throw e;
}

When it happens

Trigger: The group-name lookup returned N tokens but the group-id lookup returned fewer: NSS inconsistency between the two queries, a group deleted or renamed between the commands, or truncated output from the id helper under load.

Common situations: Flapping LDAP/AD backends, users with very large group memberships hitting output or timeout limits (hadoop.security.group.mapping.shell.command.timeout), races when membership changes mid-lookup.

Related errors

• No such group:" + group
• Does not support partial group name resolution on Windows. "
• The user name '" + userName + "' is not found. " + errMessag
• failed to get group id list for user '" + userName + "'
• Can't execute the shell command to get the list of group id

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/0e3363e51a6c1653. Report an issue: GitHub.