apache/hadoop · error · IllegalArgumentException

User {} can not be removed

Error message

User {} can not be removed

What it means

AccessControlList.removeUser throws IllegalArgumentException when the user name is a wildcard ACL value ("*"). Removing a wildcard from the user set is undefined — an all-allowed ACL has an empty user set and the allAllowed flag — so the API refuses it.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/authorize/AccessControlList.java:187

      throw new IllegalArgumentException("Group " + group + " can not be added");
    }
    if (!isAllAllowed()) {
      List<String> groupsList = new LinkedList<String>();
      groupsList.add(group);
      groupsMapping.cacheGroupsAdd(groupsList);
      groups.add(group);
    }
  }

  /**
   * Remove user from the names of users allowed for this service.
   * 
   * @param user
   *          The user name
   */
  public void removeUser(String user) {
    if (isWildCardACLValue(user)) {
      throw new IllegalArgumentException("User " + user + " can not be removed");
    }
    if (!isAllAllowed()) {
      users.remove(user);
    }
  }

  /**
   * Remove group from the names of groups allowed for this service.
   * 
   * @param group
   *          The group name
   */
  public void removeGroup(String group) {
    if (isWildCardACLValue(group)) {
      throw new IllegalArgumentException("Group " + group
          + " can not be removed");
    }
    if (!isAllAllowed()) {

View on GitHub (pinned to 2add963021)

Solutions

  1. Skip wildcard tokens before calling removeUser
  2. If the intent is 'deny everyone', rebuild the ACL instead of removing entries from a wildcard one
  3. Validate tokens against "*" at the boundary where ACL strings are parsed

Example fix

// before
for (String u : removedUsers) {
  acl.removeUser(u); // throws if u == "*"
}

// after
for (String u : removedUsers) {
  if (!"*".equals(u.trim())) {
    acl.removeUser(u.trim());
  }
}
Defensive patterns

Strategy: validation

Validate before calling

private static boolean isWildCardAclToken(String s) {
  return s == null || s.trim().isEmpty() || "*".equals(s.trim());
}

for (String u : removed) {
  if (!isWildCardAclToken(u)) {
    acl.removeUser(u.trim());
  }
}

Try / catch

try {
  acl.removeUser(user);
} catch (IllegalArgumentException e) {
  throw new ConfigException("Wildcard user token not allowed: " + user, e);
}

Prevention

When it happens

Trigger: Calling removeUser("*"); symmetrical update code that removes a set of configured tokens and encounters a wildcard; sync tools applying ACL diffs that include "*".

Common situations: ACL synchronization between config and AccessControlList objects; scripts that mirror removals from a policy file; test cleanup routines iterating over wildcard fixtures.

Related errors

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/72214317bb7ca18d. Report an issue: GitHub.