{"record":{"id":"1b0e9800bebf4abe","repo":"apache/hadoop","slug":"acl-not-of-expected-form-scheme-id","errorCode":null,"errorMessage":"ACL '{}' not of expected form scheme:id","messagePattern":"ACL '(.+?)' not of expected form scheme:id","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-registry/src/main/java/org/apache/hadoop/registry/client/impl/zk/RegistrySecurity.java","lineNumber":552,"sourceCode":"      if (next.startsWith(SCHEME_SASL +\":\") && next.endsWith(\"@\")) {\n        listIterator.set(next + realm);\n      }\n    }\n    return list;\n  }\n\n  /**\n   * Parse a string down to an ID, adding a realm if needed\n   * @param idPair id:data tuple\n   * @param realm realm to add\n   * @return the ID.\n   * @throws IllegalArgumentException if the idPair is invalid\n   */\n  public Id parse(String idPair, String realm) {\n    int firstColon = idPair.indexOf(':');\n    int lastColon = idPair.lastIndexOf(':');\n    if (firstColon == -1 || lastColon == -1 || firstColon != lastColon) {\n      throw new IllegalArgumentException(\n          \"ACL '\" + idPair + \"' not of expected form scheme:id\");\n    }\n    String scheme = idPair.substring(0, firstColon);\n    String id = idPair.substring(firstColon + 1);\n    if (id.endsWith(\"@\")) {\n      Preconditions.checkArgument(\n          StringUtils.isNotEmpty(realm),\n          \"@ suffixed account but no realm %s\", id);\n      id = id + realm;\n    }\n    return new Id(scheme, id);\n  }\n\n  /**\n   * Parse the IDs, adding a realm if needed, setting the permissions\n   * @param principalList id string\n   * @param realm realm to add\n   * @param perms permissions","sourceCodeStart":534,"sourceCodeEnd":570,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-registry/src/main/java/org/apache/hadoop/registry/client/impl/zk/RegistrySecurity.java#L534-L570","documentation":"RegistrySecurity.parse(idPair, realm) converts a string into a ZooKeeper Id of the form scheme:id; the string must contain exactly one colon (firstColon == lastColon). No colon at all, or more than one colon, throws IllegalArgumentException(\"ACL '<idPair>' not of expected form scheme:id\"). An id ending in '@' is additionally legal only when a realm is supplied, to which it is appended.","triggerScenarios":"ACL/principal-list parsing encountering entries like 'sasl' (no colon) or 'digest:user:extra' (two colons); passing a bare username or a full Kerberos principal where 'scheme:id' was expected.","commonSituations":"Editing hadoop.registry.user.accounts or principal-list configuration and omitting the scheme prefix; copy-paste of 'user@REALM' strings into a scheme:id field; hand-built ACL strings in custom registry tooling.","solutions":["Fix each entry to scheme:id form, e.g. 'sasl:alice' (optionally 'sasl:alice@' so the configured realm is appended).","Keep exactly one colon per entry; put realms after '@', not as extra colon-separated fields.","Validate entries against a ^[^:]+:[^:]+$ pattern before passing them to registry security APIs."],"exampleFix":"// before\nregistrySecurity.parse(\"digest:alice:extra\", \"REALM\"); // two colons -> IllegalArgumentException\n\n// after\nregistrySecurity.parse(\"digest:alice\", \"REALM\"); // exactly one colon: scheme:id","handlingStrategy":"validation","validationCode":"private static final Pattern SCHEME_ID = Pattern.compile(\"^[^:]+:[^:]+$\");\n\nfor (String entry : entries) {\n  if (!SCHEME_ID.matcher(entry).matches()) {\n    throw new IllegalArgumentException(\n        \"ACL '\" + entry + \"' not of expected form scheme:id\");\n  }\n}\n// entries are now safe for RegistrySecurity.parse(entry, realm)","typeGuard":null,"tryCatchPattern":"try {\n  Id id = registrySecurity.parse(idPair, realm);\n} catch (IllegalArgumentException e) {\n  // message shows the malformed pair: rewrite as scheme:id with exactly one colon\n}","preventionTips":["ACL entries are scheme:id with exactly one colon — no bare usernames, no principal-with-extra-colons.","Put the Kerberos realm after '@' (the code appends the realm for '@'-suffixed ids) instead of adding colon-separated fields.","Validate account/ACL lists with a regex before they reach registry security code."],"tags":["registry","acl","format","configuration","hadoop-registry"],"backgroundTag":"acl-format-invalid","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}