apache/pulsar · error · IllegalArgumentException

Invalid rule: remaining

Error message

Invalid rule: remaining

What it means

KerberosName.parseRules compiles the Hadoop-style auth_to_local rule string into Rule objects. Each rule must begin with a token matching the ruleParser regex (RULE:[n:string](regex)srepl or DEFAULT); otherwise the unparseable remaining substring is rejected with IllegalArgumentException.

Source

Thrown at pulsar-common/src/main/java/org/apache/pulsar/common/sasl/KerberosName.java:346

                        result = replaceSubstitution(base, fromPattern, toPattern,  repeat);
                    }
                }
            }
            if (result != null && nonSimplePattern.matcher(result).find()) {
                throw new NoMatchingRule("Non-simple name " + result
                    + " after auth_to_local rule " + this);
            }
            return result;
        }
    }

    static List<Rule> parseRules(String rules) {
        List<Rule> result = new ArrayList<Rule>();
        String remaining = rules.trim();
        while (remaining.length() > 0) {
            Matcher matcher = ruleParser.matcher(remaining);
            if (!matcher.lookingAt()) {
                throw new IllegalArgumentException("Invalid rule: " + remaining);
            }
            if (matcher.group(2) != null) {
                result.add(new Rule());
            } else {
                result.add(new Rule(Integer.parseInt(matcher.group(4)),
                    matcher.group(5),
                    matcher.group(7),
                    matcher.group(9),
                    matcher.group(10),
                    "g".equals(matcher.group(11))));
            }
            remaining = remaining.substring(matcher.end());
        }
        return result;
    }

    /**
     * Set the static configuration to get the rules.

View on GitHub (pinned to 820761864e)

Solutions

1. Correct the rule string so every rule is 'RULE:[n:string](regexp)sreplacement' or 'DEFAULT'
2. Validate each token starts with RULE: or equals DEFAULT before applying the config
3. Fix or remove the offending trailing token named in the message
4. Start with a minimal 'DEFAULT' string and add rules incrementally

Example fix

// before
KerberosName.setConfiguration("RULE:[1:$1@$0](.*)DEFAULT bogus");
// after
KerberosName.setConfiguration("RULE:[1:$1@$0](.*)DEFAULT");

static void validateAuthToLocal(String rules) {
    for (String token : rules.trim().split("\\s+")) {
        if (!token.equals("DEFAULT") && !token.startsWith("RULE:")) {
            throw new IllegalArgumentException("Invalid rule: " + token);
        }
    }
}

try {
    KerberosName.setConfiguration(rules);
} catch (IllegalArgumentException e) {
    log.error("auth_to_local rejected: {}", e.getMessage());
}

When it happens

Trigger: Calling KerberosName.setConfiguration/parseRules with a rules string containing a malformed rule, e.g. 'RULE:[1:$1@$0](.*)DEFAULT bogus' or a rule missing its '[n:s]' bracketed section.

Common situations: Hand-edited auth_to_local rules in Pulsar SASL config; rules copied from Hadoop docs with missing brackets or case-flag typos; stray whitespace-split tokens trailing the valid rules.

Related errors

• error while booting GSSAPI client
• loginContext name (JAAS file section header) was null. Pleas
• Malformed Kerberos name: name
• Authentication use SASL/JAAS/GSSAPI but server not have Prin
• Unrecognized SASL GSSAPI Server Callback.

AI-assisted analysis of apache/pulsar@820761864e (2026-09-06). Data as JSON: /api/errors/82f806cddb47a208. Report an issue: GitHub.