{"record":{"id":"03241fe962b3ad76","repo":"apache/hadoop","slug":"invalid-rule-mechanism-rulemech","errorCode":null,"errorMessage":"Invalid rule mechanism: ${ruleMech}","messagePattern":"Invalid rule mechanism: (.+?)","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/util/KerberosName.java","lineNumber":487,"sourceCode":"   * Set the rules.\n   * @param ruleString the rules string.\n   */\n  public static void setRules(String ruleString) {\n    rules = (ruleString != null) ? parseRules(ruleString) : null;\n  }\n\n  /**\n   *\n   * @param ruleMech the evaluation type: hadoop, mit\n   *                 'hadoop' indicates '@' or '/' are not allowed the result\n   *                 evaluation. 'MIT' indicates that auth_to_local\n   *                 rules follow MIT Kerberos evaluation.\n   */\n  public static void setRuleMechanism(String ruleMech) {\n    if (ruleMech != null\n            && (!ruleMech.equalsIgnoreCase(MECHANISM_HADOOP)\n            && !ruleMech.equalsIgnoreCase(MECHANISM_MIT))) {\n      throw new IllegalArgumentException(\"Invalid rule mechanism: \" + ruleMech);\n    }\n    ruleMechanism = ruleMech;\n  }\n\n  /**\n   * Get the rule evaluation mechanism\n   * @return the rule evaluation mechanism\n   */\n  public static String getRuleMechanism() {\n    return ruleMechanism;\n  }\n\n  static void printRules() throws IOException {\n    int i = 0;\n    for(Rule r: rules) {\n      System.out.println(++i + \" \" + r);\n    }\n  }","sourceCodeStart":469,"sourceCodeEnd":505,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/util/KerberosName.java#L469-L505","documentation":"KerberosName.setRuleMechanism() accepts only 'hadoop' or 'mit' (case-insensitive) for how auth_to_local rules are evaluated ('hadoop' rejects '@' or '/' in results, 'mit' follows MIT Kerberos semantics). Any other non-null value throws IllegalArgumentException naming the bad value; the property drives hadoop.security.auth_to_local.mechanism.","triggerScenarios":"Setting hadoop.security.auth_to_local.mechanism to values like 'HADOOP_KRB5', 'default', or 'Mit ' (trailing space is trimmed? no — raw string mismatch) via setRuleMechanism or core-site.xml.","commonSituations":"Copy/paste of a wrong mechanism name from old documentation; expecting an 'auto' mode that does not exist; case-variant spellings other than exact hadoop/mit (those two are case-insensitive, others are invalid).","solutions":["Set the mechanism to exactly 'hadoop' or 'mit'","Or omit the property entirely to keep the default mechanism","Validate the value in deployment tooling before it reaches core-site.xml"],"exampleFix":"<!-- before -->\n<property><name>hadoop.security.auth_to_local.mechanism</name><value>HADOOP</value></property>\n\n<!-- after -->\n<property><name>hadoop.security.auth_to_local.mechanism</name><value>hadoop</value></property>","handlingStrategy":"validation","validationCode":"boolean isValidMechanism(String m) {\n  return m == null || \"hadoop\".equalsIgnoreCase(m) || \"mit\".equalsIgnoreCase(m);\n}","typeGuard":null,"tryCatchPattern":"not needed — fix the config value; catching and continuing would silently change auth_to_local semantics","preventionTips":["Restrict hadoop.security.auth_to_local.mechanism to hadoop|mit in config validation","Omit the property to use the default rather than guessing values"],"tags":["kerberos","configuration","auth-to-local","invalid-value"],"backgroundTag":"invalid-config-value","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}