{"record":{"id":"3ad62e0b29445977","repo":"apache/hadoop","slug":"parsing","errorCode":null,"errorMessage":"Parsing {} :{}","messagePattern":"Parsing (.+?) :(.+?)","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-registry/src/main/java/org/apache/hadoop/registry/client/impl/zk/RegistrySecurity.java","lineNumber":598,"sourceCode":"      newAcl.setId(parse(aclPair, realm));\n      newAcl.setPerms(perms);\n      ids.add(newAcl);\n    }\n    return ids;\n  }\n\n  /**\n   * Parse an ACL list. This includes configuration indirection\n   * {@link ZKUtil#resolveConfIndirection(String)}\n   * @param zkAclConf configuration string\n   * @return an ACL list\n   * @throws IOException on a bad ACL parse\n   */\n  public List<ACL> parseACLs(String zkAclConf) throws IOException {\n    try {\n      return ZKUtil.parseACLs(ZKUtil.resolveConfIndirection(zkAclConf));\n    } catch (ZKUtil.BadAclFormatException e) {\n      throw new IOException(\"Parsing \" + zkAclConf + \" :\" + e, e);\n    }\n  }\n\n  /**\n   * Get the appropriate Kerberos Auth module for JAAS entries\n   * for this JVM.\n   * @return a JVM-specific kerberos login module classname.\n   */\n  public static String getKerberosAuthModuleForJVM() {\n    if (System.getProperty(\"java.vendor\").contains(\"IBM\")) {\n      return \"com.ibm.security.auth.module.Krb5LoginModule\";\n    } else {\n      return \"com.sun.security.auth.module.Krb5LoginModule\";\n    }\n  }\n\n  /**\n   * JAAS template: {@value}","sourceCodeStart":580,"sourceCodeEnd":616,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-registry/src/main/java/org/apache/hadoop/registry/client/impl/zk/RegistrySecurity.java#L580-L616","documentation":"RegistrySecurity.parseACLs(zkAclConf) first resolves configuration indirection (ZKUtil.resolveConfIndirection, e.g. file or command references) and then parses the string with ZKUtil.parseACLs, which requires every entry to be scheme:id:perms with perms drawn from ZooKeeper's crdwda set. A BadAclFormatException is wrapped as IOException('Parsing <conf> :<cause>') — the text after the colon carries the underlying reason and the <conf> echo shows exactly which string failed.","triggerScenarios":"An ACL configuration string with an entry missing the perms field ('world:anyone'), unknown permission letters, a stray comma, or indirection output that is not a valid ACL list.","commonSituations":"Hand-writing registry/ZooKeeper ACL strings in site XML; copying examples that omit the perms segment; changing permission shorthand between versions; entries like 'sasl:alice@REALM' where ':cdrwa' was forgotten.","solutions":["Write entries as scheme:id:perms, e.g. 'world:anyone:r', 'sasl:alice@REALM:cdrwa'.","Read the inner BadAclFormatException message carried after the colon — it names the malformed entry.","Dry-run your ACL config through ZKUtil.parseACLs(ZKUtil.resolveConfIndirection(value)) at startup so mistakes fail fast with the precise cause."],"exampleFix":"// before\nconf.set(\"hadoop.registry.acl\", \"sasl:alice@REALM\"); // perms missing -> IOException \"Parsing ...\"\n\n// after\nconf.set(\"hadoop.registry.acl\", \"sasl:alice@REALM:cdrwa,world:anyone:r\");","handlingStrategy":"validation","validationCode":"// fail fast on bad ACL config at startup\nString value = conf.get(\"hadoop.registry.acl\", null);\nif (value != null) {\n  try {\n    ZKUtil.parseACLs(ZKUtil.resolveConfIndirection(value));\n  } catch (ZKUtil.BadAclFormatException e) {\n    throw new IllegalArgumentException(\"Bad registry ACL config: \" + value, e);\n  }\n}","typeGuard":null,"tryCatchPattern":"try {\n  List<ACL> acls = registrySecurity.parseACLs(zkAclConf);\n} catch (IOException e) {\n  // the wrapped BadAclFormatException after 'Parsing <conf> :' names the malformed entry;\n  // rewrite entries as scheme:id:perms (e.g. world:anyone:r, sasl:alice@REALM:cdrwa)\n}","preventionTips":["Every ACL entry needs three colon-separated parts: scheme, id, perms (from crdwda).","Dry-run ACL strings through ZKUtil.parseACLs in a config-validation test.","When using indirection (file/command values), validate the resolved output, not just the configured string."],"tags":["registry","zookeeper","acl","configuration","format","hadoop-registry"],"backgroundTag":"acl-format-invalid","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}