{"record":{"id":"184cc98fcdac11dc","repo":"apache/hadoop","slug":"invalid-id-password","errorCode":null,"errorMessage":"Invalid id:password","messagePattern":"Invalid id:password","errorType":"validation","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-registry/src/main/java/org/apache/hadoop/registry/client/impl/zk/RegistrySecurity.java","lineNumber":468,"sourceCode":"  }\n\n  /**\n   * Get the derived kerberos realm.\n   * @return this is built from the JVM realm, or the configuration if it\n   * overrides it. If \"\", it means \"don't know\".\n   */\n  public String getKerberosRealm() {\n    return kerberosRealm;\n  }\n\n  /**\n   * Generate a base-64 encoded digest of the idPasswordPair pair\n   * @param idPasswordPair id:password\n   * @return a string that can be used for authentication\n   */\n  public String digest(String idPasswordPair) throws IOException {\n    if (StringUtils.isEmpty(idPasswordPair) || !isValid(idPasswordPair)) {\n      throw new IOException(\"Invalid id:password\");\n    }\n    try {\n      return DigestAuthenticationProvider.generateDigest(idPasswordPair);\n    } catch (NoSuchAlgorithmException e) {\n      // unlikely since it is standard to the JVM, but maybe JCE restrictions\n      // could trigger it\n      throw new IOException(e.toString(), e);\n    }\n  }\n\n  /**\n   * Generate a base-64 encoded digest of the idPasswordPair pair\n   * @param id ID\n   * @param password pass\n   * @return a string that can be used for authentication\n   * @throws IOException\n   */\n  public String digest(String id, String password) throws IOException {","sourceCodeStart":450,"sourceCodeEnd":486,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-registry/src/main/java/org/apache/hadoop/registry/client/impl/zk/RegistrySecurity.java#L450-L486","documentation":"RegistrySecurity.digest(idPasswordPair) generates a ZooKeeper digest but first validates the pair: it must be non-empty and pass isValid(), which — stricter than ZooKeeper's own DigestAuthenticationProvider — requires both the id and the password halves to be non-empty around a single colon. Anything else (missing colon, empty id, empty password) throws IOException('Invalid id:password').","triggerScenarios":"digest(\"user:\"), digest(\":pass\") or digest(\"no-colon\"); in the built-in flow, initSecurity calls digest(id, pass) where either configured credential is empty; a password containing a colon also breaks the id:pass pairing.","commonSituations":"Setting only one of auth.id/auth.password; placeholder or blank credentials in config files; digest accounts whose generated password happens to contain ':' characters.","solutions":["Set both the id and the password to non-empty values that contain no colons.","Validate the 'id:password' format (exactly one colon, both halves non-empty) before constructing the registry client.","Rotate the digest account credentials if the current password contains a colon."],"exampleFix":"// before\nregistrySecurity.digest(\"registry:\"); // empty password -> IOException(\"Invalid id:password\")\n\n// after\nregistrySecurity.digest(\"registry:secret\"); // one colon, both halves non-empty","handlingStrategy":"validation","validationCode":"private static final Pattern ID_PASS = Pattern.compile(\"^[^:]+:[^:]+$\");\n\nvoid checkDigestPair(String id, String pass) {\n  String pair = id + \":\" + pass;\n  if (!ID_PASS.matcher(pair).matches()) {\n    throw new IllegalArgumentException(\"Invalid id:password (need non-empty id and pass, no colons)\");\n  }\n}\n// run before creating the digest-authenticated registry client","typeGuard":null,"tryCatchPattern":"try {\n  registrySecurity.digest(pair);\n} catch (IOException e) {\n  if (\"Invalid id:password\".equals(e.getMessage())) {\n    // fix the id/password pair: both halves non-empty, exactly one colon\n  }\n}","preventionTips":["Never leave one of auth.id/auth.password blank in digest configurations.","Keep colons out of digest ids and passwords (they break the id:pass pairing).","Unit-test credential formatting before deploying digest-based registry clients."],"tags":["registry","digest","credentials","validation","hadoop-registry"],"backgroundTag":"invalid-credentials-format","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}