apache/hadoop · error · IllegalArgumentException

user is null.

Error message

user is null.

What it means

DefaultImpersonationProvider.authorize throws IllegalArgumentException when the user argument is null. The provider must inspect the effective UserGroupInformation (and its real user) to evaluate proxy ACLs, so a null user is a caller bug, not a authorization failure.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/authorize/DefaultImpersonationProvider.java:113

    // get hosts per proxyuser
    allMatchKeys = conf.getValByRegex(hostsRegEx);
    for(Entry<String, String> entry : allMatchKeys.entrySet()) {
      proxyHosts.put(entry.getKey(),
          new MachineList(entry.getValue()));
    }
  }

  @Override
  public Configuration getConf() {
    return conf;
  }

  @Override
  public void authorize(UserGroupInformation user,
      InetAddress remoteAddress) throws AuthorizationException {
    
    if (user == null) {
      throw new IllegalArgumentException("user is null.");
    }

    UserGroupInformation realUser = user.getRealUser();
    if (realUser == null) {
      return;
    }
    
    AccessControlList acl = proxyUserAcl.get(configPrefix +
        realUser.getShortUserName());
    if (acl == null || !acl.isUserAllowed(user)) {
      throw new AuthorizationException("User: " + realUser.getUserName()
          + " is not allowed to impersonate " + user.getUserName());
    }

    MachineList MachineList = proxyHosts.get(
        getProxySuperuserIpConfKey(realUser.getShortUserName()));

    if(MachineList == null || !MachineList.includes(remoteAddress)) {

View on GitHub (pinned to 2add963021)

Solutions

1. Null-check the UserGroupInformation before calling authorize and fail authentication explicitly
2. Build the UGI properly: UserGroupInformation.createProxyUser(proxyUser, realUser) or UserGroupInformation.getCurrentUser()
3. In tests, create a remote UGI via UserGroupInformation.createRemoteUser(...) instead of null

Example fix

// before
proxyUsers.authorize(user, remoteAddress); // user may be null

// after
if (user == null) {
  throw new AuthenticationException("No authenticated user for impersonation check");
}
proxyUsers.authorize(user, remoteAddress);

if (user == null) {
  throw new AuthenticationException("Impersonation check requires an authenticated user");
}
impersonationProvider.authorize(user, remoteAddress);

private static boolean isAuthorizableUgi(UserGroupInformation ugi) {
  return ugi != null && ugi.getUserName() != null;
}

try {
  ProxyUsers.authorize(user, remoteAddress);
} catch (IllegalArgumentException e) {
  // caller bug: reject request, do not retry
  throw new AuthenticationException("Malformed proxy request", e);
}

When it happens

Trigger: Calling ProxyUsers.authorize(null, remoteAddress) or DefaultImpersonationProvider.authorize(null, addr); passing a UGI variable that was never assigned because authentication was skipped or failed earlier in the call chain.

Common situations: Custom RPC servers invoking the impersonation check before authentication completes; test harnesses passing null; refactors that drop the getCurrentUser() call; doAs blocks where the proxy UGI was constructed incorrectly.

Related errors

• User: {} is not allowed to impersonate {}
• Null real user
• Unauthorized connection for super-user: {} from IP {}
• Failed to rename %s to %s, file already exists or not empty!
• Permission denied: user=%s, path="%s":%s:%s:%s%s

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/e18f5b929ec0b747. Report an issue: GitHub.