{"record":{"id":"3c1361eef5d04549","repo":"apache/hadoop","slug":"null-real-user","errorCode":null,"errorMessage":"Null real user","messagePattern":"Null real user","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/UserGroupInformation.java","lineNumber":1529,"sourceCode":"    }\n  };\n\n  /**\n   * Create a proxy user using username of the effective user and the ugi of the\n   * real user.\n   * @param user user.\n   * @param realUser realUser.\n   * @return proxyUser ugi\n   */\n  @InterfaceAudience.Public\n  @InterfaceStability.Evolving\n  public static UserGroupInformation createProxyUser(String user,\n      UserGroupInformation realUser) {\n    if (user == null || user.isEmpty()) {\n      throw new IllegalArgumentException(\"Null user\");\n    }\n    if (realUser == null) {\n      throw new IllegalArgumentException(\"Null real user\");\n    }\n    Subject subject = new Subject();\n    Set<Principal> principals = subject.getPrincipals();\n    principals.add(new User(user, AuthenticationMethod.PROXY, null));\n    principals.add(new RealUser(realUser));\n    return new UserGroupInformation(subject);\n  }\n\n  /**\n   * get RealUser (vs. EffectiveUser)\n   * @return realUser running over proxy user\n   */\n  @InterfaceAudience.Public\n  @InterfaceStability.Evolving\n  public UserGroupInformation getRealUser() {\n    for (RealUser p: subject.getPrincipals(RealUser.class)) {\n      return p.getRealUser();\n    }","sourceCodeStart":1511,"sourceCodeEnd":1547,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/UserGroupInformation.java#L1511-L1547","documentation":"UGI.createProxyUser requires a non-null real (authenticating) user to attach as RealUser principal; null is rejected with IllegalArgumentException('Null real user'). A proxy identity is meaningless without the identity it is derived from.","triggerScenarios":"createProxyUser(user, null) - the real user UGI was never logged in, a lookup returned null, or an optional-authentication path skipped login.","commonSituations":"Calling createProxyUser before the real user's login completed; static initialization ordering where realUser is assigned later; refactors dropping the login call.","solutions":["Log in the real user first (loginUserFromKeytab/loginUserFromTicketCache/getLoginUser) and pass that UGI","Null-check the real user UGI and fail fast with a descriptive error naming the missing login step","Review call ordering in proxy pipelines so the authenticated UGI exists before proxying"],"exampleFix":"// before\nUserGroupInformation proxy =\n    UserGroupInformation.createProxyUser(proxyUser, realUser);\n// after\nObjects.requireNonNull(realUser, \"real user must be logged in first\");\nUserGroupInformation proxy =\n    UserGroupInformation.createProxyUser(proxyUser, realUser);","handlingStrategy":"validation","validationCode":"Objects.requireNonNull(realUser, \"real user must be logged in first\");\nUserGroupInformation.createProxyUser(proxyUser, realUser);","typeGuard":"static boolean isUsableRealUser(UserGroupInformation realUser) {\n  return realUser != null && realUser.getUserName() != null;\n}","tryCatchPattern":null,"preventionTips":["Complete the real user's login before any proxying code runs","Fail fast with a message naming the missing login step","Wire proxy creation through one factory that enforces both arguments"],"tags":["hadoop","ugi","proxy-user","null-check"],"backgroundTag":"null-argument","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}