apache/hadoop · error · PartialGroupNameException

The user name '" + userName + "' is not found. " + errMessag

Error message

The user name '" + userName + "' is not found. " + errMessage

What it means

ShellBasedUnixGroupsMapping.resolvePartialGroupNames is entered after the primary group lookup already failed. If the partially captured output contains no group names at all, the user itself is unknown, so PartialGroupNameException reports 'The user name X is not found' plus the original shell error text.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/ShellBasedUnixGroupsMapping.java:291

   *
   * @param userName the user's name
   * @param errMessage error message from the shell command
   * @param groupNames the incomplete list of group names
   * @return a set of resolved group names
   * @throws PartialGroupNameException if the resolution fails or times out
   */
  private Set<String> resolvePartialGroupNames(String userName,
      String errMessage, String groupNames) throws PartialGroupNameException {
    // Exception may indicate that some group names are not resolvable.
    // Shell-based implementation should tolerate unresolvable groups names,
    // and return resolvable ones, similar to what JNI-based implementation
    // does.
    if (Shell.WINDOWS) {
      throw new PartialGroupNameException("Does not support partial group"
      + " name resolution on Windows. " + errMessage);
    }
    if (groupNames.isEmpty()) {
      throw new PartialGroupNameException("The user name '" + userName
          + "' is not found. " + errMessage);
    } else {
      LOG.warn("Some group names for '{}' are not resolvable. {}",
          userName, errMessage);
      // attempt to partially resolve group names
      ShellCommandExecutor partialResolver = createGroupIDExecutor(userName);
      try {
        partialResolver.execute();
        return parsePartialGroupNames(
            groupNames, partialResolver.getOutput());
      } catch (ExitCodeException ece) {
        // If exception is thrown trying to get group id list,
        // something is terribly wrong, so give up.
        throw new PartialGroupNameException(
            "failed to get group id list for user '" + userName + "'", ece);
      } catch (IOException ioe) {
        String message =
            "Can't execute the shell command to " +

View on GitHub (pinned to 2add963021)

Solutions

1. Confirm the user exists on the mapping node: 'id <user>' / 'getent passwd <user>'
2. Fix LDAP search filters or domain trust so the user resolves
3. Add static mapping overrides (hadoop.user.group.static.mapping.overrides) for synthetic users
4. Validate usernames at the entry point (proxy ACLs, gateway auth) before they reach group mapping

static boolean userExists(String user) throws IOException {
  Process p = new ProcessBuilder("id", user).start();
  try { return p.waitFor() == 0; }
  finally { p.destroy(); }
}
// gate proxy/gateway usernames through this before group mapping

When it happens

Trigger: Group mapping is requested for a user that does not exist on the host (no passwd/AD object), so the shell lookup prints an error and an empty name list; typical when client-supplied usernames reach ShellBasedUnixGroupsMapping unvalidated.

Common situations: Proxy users or NFS/WebHDFS gateways forwarding usernames absent from the mapping host; typos; users from an untrusted domain without proper trust or search filters.

Related errors

• No such group:" + group
• Number of group names and ids do not match. group name =" +
• failed to get group id list for user '" + userName + "'
• Can't execute the shell command to get the list of group id
• Configuration hadoop.user.group.static.mapping.overrides is

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/b768601674b92106. Report an issue: GitHub.