{"record":{"id":"17732b6641eee7b3","repo":"apache/hadoop","slug":"parameter-0-cannot-be-null","errorCode":null,"errorMessage":"Parameter [{0}], cannot be NULL","messagePattern":"Parameter \\[(.+?)\\], cannot be NULL","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"hadoop-hdfs-project/hadoop-hdfs-client/src/main/java/org/apache/hadoop/hdfs/web/resources/UserParam.java","lineNumber":53,"sourceCode":"      Pattern.compile(DFS_WEBHDFS_USER_PATTERN_DEFAULT));\n\n  @VisibleForTesting\n  public static Domain getUserPatternDomain() {\n    return domain;\n  }\n\n  @VisibleForTesting\n  public static void setUserPatternDomain(Domain dm) {\n    domain = dm;\n  }\n\n  public static void setUserPattern(String pattern) {\n    domain = new Domain(NAME, Pattern.compile(pattern));\n  }\n\n  private static String validateLength(String str) {\n    if (str == null) {\n      throw new IllegalArgumentException(\n        MessageFormat.format(\"Parameter [{0}], cannot be NULL\", NAME));\n    }\n    int len = str.length();\n    if (len < 1) {\n      throw new IllegalArgumentException(MessageFormat.format(\n        \"Parameter [{0}], it's length must be at least 1\", NAME));\n    }\n    return str;\n  }\n\n  /**\n   * Constructor.\n   * @param str a string representation of the parameter value.\n   */\n  public UserParam(final String str) {\n    super(domain, str == null ||\n        str.equals(DEFAULT) ? null : validateLength(str));\n  }","sourceCodeStart":35,"sourceCodeEnd":71,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-hdfs-project/hadoop-hdfs-client/src/main/java/org/apache/hadoop/hdfs/web/resources/UserParam.java#L35-L71","documentation":"UserParam.validateLength (UserParam.java:51-62) throws this MessageFormat'd IllegalArgumentException when the username it must embed in the user.name parameter is null. Only the UserParam(UserGroupInformation) constructor at UserParam.java:76-78 can reach it: it calls ugi.getShortUserName(), and the String constructor maps null/empty to 'parameter absent' instead. It therefore signals a UserGroupInformation whose short user name is null — a broken authentication identity rather than a bad HTTP parameter.","triggerScenarios":"new UserParam(UserGroupInformation.getCurrentUser()) when the current UGI's short name is null — e.g. a Kerberos principal with no user component ('@REALM' or a malformed principal), a UGI assembled with null in tests, or a custom authentication filter that produced an empty principal.","commonSituations":"Keytab login with a service principal missing its primary part; SPNEGO handshakes where the negotiated principal fails to parse; unit tests constructing UserGroupInformation.createProxyUser or mock UGIs without a real name; upgrading JDK/Kerberos libs that alter principal parsing.","solutions":["Check UserGroupInformation.getLoginUser().getShortUserName() before issuing WebHDFS calls and fail fast with a clear message if it is null.","Fix the principal: keytabs must use user/host@REALM with a non-empty user part; re-run kinit and verify with klist.","In tests, use UserGroupInformation.createUserForTesting(\"user\", groups) or RemoteUserMock instead of half-built UGIs."],"exampleFix":"// before\nUserGroupInformation ugi = UserGroupInformation.getCurrentUser();\nconn.setRequestProperty... new UserParam(ugi).toQueryString()\n// after\nUserGroupInformation ugi = UserGroupInformation.getCurrentUser();\nString shortName = ugi.getShortUserName();\nif (shortName == null || shortName.isEmpty()) {\n  throw new IllegalStateException(\"Kerberos principal has no user part: \" + ugi.getUserName());\n}","handlingStrategy":"validation","validationCode":"static UserGroupInformation requireNamedUgi() {\n  UserGroupInformation ugi = UserGroupInformation.getLoginUser();\n  if (ugi.getShortUserName() == null) throw new IllegalStateException(\"UGI has null short username: \" + ugi.getUserName());\n  return ugi;\n}","typeGuard":"static boolean hasShortUserName(UserGroupInformation ugi) { return ugi != null && ugi.getShortUserName() != null; }","tryCatchPattern":null,"preventionTips":["Fail fast at startup if the Kerberos principal has no primary component.","Verify keytab principals with klist before starting jobs that use WebHDFS."],"tags":["webhdfs","kerberos","user-param","authentication","hdfs"],"backgroundTag":"missing-user-parameter","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}