apache/hadoop · error · IOException

Parsing {} :{}

Error message

Parsing {} :{}

What it means

RegistrySecurity.parseACLs(zkAclConf) first resolves configuration indirection (ZKUtil.resolveConfIndirection, e.g. file or command references) and then parses the string with ZKUtil.parseACLs, which requires every entry to be scheme:id:perms with perms drawn from ZooKeeper's crdwda set. A BadAclFormatException is wrapped as IOException('Parsing <conf> :<cause>') — the text after the colon carries the underlying reason and the <conf> echo shows exactly which string failed.

Source

Thrown at hadoop-common-project/hadoop-registry/src/main/java/org/apache/hadoop/registry/client/impl/zk/RegistrySecurity.java:598

      newAcl.setId(parse(aclPair, realm));
      newAcl.setPerms(perms);
      ids.add(newAcl);
    }
    return ids;
  }

  /**
   * Parse an ACL list. This includes configuration indirection
   * {@link ZKUtil#resolveConfIndirection(String)}
   * @param zkAclConf configuration string
   * @return an ACL list
   * @throws IOException on a bad ACL parse
   */
  public List<ACL> parseACLs(String zkAclConf) throws IOException {
    try {
      return ZKUtil.parseACLs(ZKUtil.resolveConfIndirection(zkAclConf));
    } catch (ZKUtil.BadAclFormatException e) {
      throw new IOException("Parsing " + zkAclConf + " :" + e, e);
    }
  }

  /**
   * Get the appropriate Kerberos Auth module for JAAS entries
   * for this JVM.
   * @return a JVM-specific kerberos login module classname.
   */
  public static String getKerberosAuthModuleForJVM() {
    if (System.getProperty("java.vendor").contains("IBM")) {
      return "com.ibm.security.auth.module.Krb5LoginModule";
    } else {
      return "com.sun.security.auth.module.Krb5LoginModule";
    }
  }

  /**
   * JAAS template: {@value}

View on GitHub (pinned to 2add963021)

Solutions

1. Write entries as scheme:id:perms, e.g. 'world:anyone:r', 'sasl:alice@REALM:cdrwa'.
2. Read the inner BadAclFormatException message carried after the colon — it names the malformed entry.
3. Dry-run your ACL config through ZKUtil.parseACLs(ZKUtil.resolveConfIndirection(value)) at startup so mistakes fail fast with the precise cause.

Example fix

// before
conf.set("hadoop.registry.acl", "sasl:alice@REALM"); // perms missing -> IOException "Parsing ..."

// after
conf.set("hadoop.registry.acl", "sasl:alice@REALM:cdrwa,world:anyone:r");

// fail fast on bad ACL config at startup
String value = conf.get("hadoop.registry.acl", null);
if (value != null) {
  try {
    ZKUtil.parseACLs(ZKUtil.resolveConfIndirection(value));
  } catch (ZKUtil.BadAclFormatException e) {
    throw new IllegalArgumentException("Bad registry ACL config: " + value, e);
  }
}

try {
  List<ACL> acls = registrySecurity.parseACLs(zkAclConf);
} catch (IOException e) {
  // the wrapped BadAclFormatException after 'Parsing <conf> :' names the malformed entry;
  // rewrite entries as scheme:id:perms (e.g. world:anyone:r, sasl:alice@REALM:cdrwa)
}

When it happens

Trigger: An ACL configuration string with an entry missing the perms field ('world:anyone'), unknown permission letters, a stray comma, or indirection output that is not a valid ACL list.

Common situations: Hand-writing registry/ZooKeeper ACL strings in site XML; copying examples that omit the perms segment; changing permission shorthand between versions; entries like 'sasl:alice@REALM' where ':cdrwa' was forgotten.

Related errors

• ACL '{}' not of expected form scheme:id
• Empty ACL list
• No user for ACLs determinable from current user or registry
• Entry "%s" not found; JAAS config = %s
• SASL is configured for registry, but neither keytab/principa

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/3ad62e0b29445977. Report an issue: GitHub.