{"record":{"id":"0e3363e51a6c1653","repo":"apache/hadoop","slug":"number-of-group-names-and-ids-do-not-match-group","errorCode":null,"errorMessage":"Number of group names and ids do not match. group name =\" + groupNames + \", group id = \" + groupIDs","messagePattern":"Number of group names and ids do not match\\. group name =\" \\+ groupNames \\+ \", group id = \" \\+ groupIDs","errorType":"exception","errorClass":"PartialGroupNameException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/ShellBasedUnixGroupsMapping.java","lineNumber":252,"sourceCode":"   * Attempt to parse group names given that some names are not resolvable.\n   * Use the group id list to identify those that are not resolved.\n   *\n   * @param groupNames a string representing a list of group names\n   * @param groupIDs a string representing a list of group ids\n   * @return a linked list of group names\n   * @throws PartialGroupNameException\n   */\n  private Set<String> parsePartialGroupNames(String groupNames,\n      String groupIDs) throws PartialGroupNameException {\n    StringTokenizer nameTokenizer =\n        new StringTokenizer(groupNames, Shell.TOKEN_SEPARATOR_REGEX);\n    StringTokenizer idTokenizer =\n        new StringTokenizer(groupIDs, Shell.TOKEN_SEPARATOR_REGEX);\n    Set<String> groups = new LinkedHashSet<>();\n    while (nameTokenizer.hasMoreTokens()) {\n      // check for unresolvable group names.\n      if (!idTokenizer.hasMoreTokens()) {\n        throw new PartialGroupNameException(\"Number of group names and ids do\"\n        + \" not match. group name =\" + groupNames + \", group id = \" + groupIDs);\n      }\n      String groupName = nameTokenizer.nextToken();\n      String groupID = idTokenizer.nextToken();\n      if (!StringUtils.isNumeric(groupName) ||\n          !groupName.equals(groupID)) {\n        // if the group name is non-numeric, it is resolved.\n        // if the group name is numeric, but is not the same as group id,\n        // regard it as a group name.\n        // if unfortunately, some group names are not resolvable, and\n        // the group name is the same as the group id, regard it as not\n        // resolved.\n        groups.add(groupName);\n      }\n    }\n    return groups;\n  }\n","sourceCodeStart":234,"sourceCodeEnd":270,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/ShellBasedUnixGroupsMapping.java#L234-L270","documentation":"When some of a user's groups fail to resolve, ShellBasedUnixGroupsMapping.parsePartialGroupNames tokenizes the group names already obtained and the ids from an 'id -G'-style command, walking both tokenizers in lockstep. If there are more name tokens than id tokens, the lists cannot be aligned and PartialGroupNameException is thrown showing both raw lists.","triggerScenarios":"The group-name lookup returned N tokens but the group-id lookup returned fewer: NSS inconsistency between the two queries, a group deleted or renamed between the commands, or truncated output from the id helper under load.","commonSituations":"Flapping LDAP/AD backends, users with very large group memberships hitting output or timeout limits (hadoop.security.group.mapping.shell.command.timeout), races when membership changes mid-lookup.","solutions":["On the mapping host run 'id <user>' and 'id -G <user>' and compare the counts","Fix inconsistency in the directory/NSS backend so both views agree","Raise hadoop.security.group.mapping.shell.command.timeout if truncation or timeouts are suspected","Switch to LdapGroupsMapping for direct LDAP group resolution to avoid shell semantics"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  List<String> groups = groups.getGroups(user);\n} catch (PartialGroupNameException e) {\n  if (e.getMessage().contains(\"do not match\")) {\n    // re-run 'id user' vs 'id -G user' on the mapping host; flag NSS inconsistency\n  }\n  throw e;\n}","preventionTips":["Compare 'id' and 'id -G' output in health checks on mapping hosts","Size hadoop.security.group.mapping.shell.command.timeout above worst-case lookup time","Consider LdapGroupsMapping where directory consistency is guaranteed"],"tags":["unix","group-mapping","ldap","partial-resolution"],"backgroundTag":"group-resolution-failed","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}