{"record":{"id":"27d67b723cc7f045","repo":"apache/hadoop","slug":"malformed-kerberos-name-name","errorCode":null,"errorMessage":"Malformed Kerberos name: ${name}","messagePattern":"Malformed Kerberos name: (.+?)","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/util/KerberosName.java","lineNumber":122,"sourceCode":"  @VisibleForTesting\n  public static void resetDefaultRealm() {\n    try {\n      defaultRealm = KerberosUtil.getDefaultRealm();\n    } catch (Exception ke) {\n      LOG.debug(\"resetting default realm failed, \"\n          + \"current default realm will still be used.\", ke);\n    }\n  }\n\n  /**\n   * Create a name from the full Kerberos principal name.\n   * @param name full Kerberos principal name.\n   */\n  public KerberosName(String name) {\n    Matcher match = nameParser.matcher(name);\n    if (!match.matches()) {\n      if (name.contains(\"@\")) {\n        throw new IllegalArgumentException(\"Malformed Kerberos name: \" + name);\n      } else {\n        serviceName = name;\n        hostName = null;\n        realm = null;\n      }\n    } else {\n      serviceName = match.group(1);\n      hostName = match.group(3);\n      realm = match.group(5);\n    }\n  }\n\n  /**\n   * Get the configured default realm.\n   * Used syncronized method here, because double-check locking is overhead.\n   * @return the default realm from the krb5.conf\n   */\n  public static synchronized String getDefaultRealm() {","sourceCodeStart":104,"sourceCodeEnd":140,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/util/KerberosName.java#L104-L140","documentation":"KerberosName parses a full principal as serviceName[/host]@REALM using a strict regex. When the string contains '@' but still fails to match the pattern, the constructor throws IllegalArgumentException('Malformed Kerberos name'), because an '@' implies a realm was intended and the shape must be legal.","triggerScenarios":"new KerberosName(name) / HadoopKerberosName translation with strings like 'alice@REALM@EXTRA' (two '@'), '@REALM' (empty service), 'alice/bob@R@S', or embedded whitespace or escaped separators in wrong positions.","commonSituations":"Email-style usernames passed where a Kerberos principal is expected; principals built by concatenating user + '@' + realm with a null/empty user; unusual KDC escapes or DN fragments reaching auth_to_local translation.","solutions":["Inspect the offending name and fix the producer so it emits a single 'service[/host]@REALM' form","Guard call sites with a format check for at most one '@' and '/' placement before constructing KerberosName","Where legacy names are legitimate, rely on auth_to_local RULEs instead of feeding malformed strings to KerberosName"],"exampleFix":"// before\nKerberosName kn = new KerberosName(userName + \"@\" + realm + \"@\" + extra);\n\n// after: exactly one realm, correctly placed\nKerberosName kn = new KerberosName(userName + \"@\" + realm);","handlingStrategy":"validation","validationCode":"private static final java.util.regex.Pattern PRINCIPAL =\n    java.util.regex.Pattern.compile(\"([^/@]+)(/([^/@]+))?(@([^/@]+))?\");\nboolean isPlausiblePrincipal(String name) {\n  return name != null && !name.contains(\"@@\") && PRINCIPAL.matcher(name).matches();\n}","typeGuard":null,"tryCatchPattern":"try { new KerberosName(name); } catch (IllegalArgumentException e) { /* reject login, log name, never fall back to raw string as identity */ }","preventionTips":["Validate principal shape before KerberosName construction","Reject multiple '@' or misplaced '/' in user-supplied principal strings","Test auth_to_local translation with HadoopKerberosName during config changes"],"tags":["kerberos","hadoop-auth","principal","validation"],"backgroundTag":"kerberos-principal-invalid","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}