{"record":{"id":"3d9b9b8485649c82","repo":"apache/pulsar","slug":"malformed-kerberos-name-name","errorCode":null,"errorMessage":"Malformed Kerberos name: name","messagePattern":"Malformed Kerberos name: name","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"pulsar-common/src/main/java/org/apache/pulsar/common/sasl/KerberosName.java","lineNumber":126,"sourceCode":"            // setConfiguration() will work even if the above try() fails due\n            // to a missing Kerberos configuration (unless zookeeper.requireKerberosConfig\n            // is set to true, which would not allow execution to reach here due to the\n            // throwing of an IllegalArgumentException above).\n            setConfiguration();\n        } catch (IOException e) {\n            throw new IllegalArgumentException(\"Could not configure Kerberos principal name mapping.\");\n        }\n    }\n\n    /**\n     * Create a name from the full Kerberos principal name.\n     * @param name\n     */\n    public KerberosName(String name) {\n        Matcher match = nameParser.matcher(name);\n        if (!match.matches()) {\n            if (name.contains(\"@\")) {\n                throw new IllegalArgumentException(\"Malformed Kerberos name: \" + name);\n            } else {\n                serviceName = name;\n                hostName = null;\n                realm = null;\n            }\n        } else {\n            serviceName = match.group(1);\n            hostName = match.group(3);\n            realm = match.group(4);\n        }\n    }\n\n    /**\n     * Get the configured default realm.\n     * @return the default realm from the krb5.conf\n     */\n    public String getDefaultRealm() {\n        return defaultRealm;","sourceCodeStart":108,"sourceCodeEnd":144,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-common/src/main/java/org/apache/pulsar/common/sasl/KerberosName.java#L108-L144","documentation":"KerberosName parses a Kerberos principal into service name, host, and realm. If the name contains '@' (implying a realm) but does not match the configured name parser pattern, it is considered structurally malformed and an IllegalArgumentException is thrown. Names without '@' are accepted as a bare service name with no host or realm.","triggerScenarios":"Calling new KerberosName(String) with a string containing '@' whose overall form (service/host@REALM with optional components) fails the nameParser regex, e.g. 'user@@REALM', '@REALM', or 'svc/host@REALM@EXTRA'.","commonSituations":"Misconfigured principal settings in Pulsar SASL/Kerberos authentication config; copy-pasted principals with doubled '@'; environment-variable substitution leaving '@' with an empty user part.","solutions":["Fix the configured principal to match service/host@REALM format, e.g. 'client/broker.example.com@EXAMPLE.COM'","Remove the '@' if you intended a bare service name (no realm)","Check for environment-variable expansion mistakes that doubled or emptied parts of the principal","Verify the JAAS/GSS configuration matches the expected principal syntax"],"exampleFix":"// before\nnew KerberosName(\"client@@EXAMPLE.COM\");\n// after\nnew KerberosName(\"client/broker.example.com@EXAMPLE.COM\");","handlingStrategy":"validation","validationCode":"boolean isValidKerberosName(String name) {\n    return name == null || !name.contains(\"@\")\n        || name.matches(\"[^/@]+/[^@]+@[^@]+|[^/@]+@[^@]+|[^/@]+/[^@]+@$|[^/@]+@$|@[^@]+@|.*@@.*\") == false && name.matches(\"[^/]+/[^@]+@[^@]+|[^/@]+@[^@]+\");\n}\n// call before: new KerberosName(name)","typeGuard":"boolean hasRealm(String principal) {\n    return principal != null && principal.indexOf('@') == principal.lastIndexOf('@') && principal.indexOf('@') > 0;\n}","tryCatchPattern":"try {\n    KerberosName k = new KerberosName(name);\n} catch (IllegalArgumentException e) {\n    log.error(\"Malformed principal '{}': expected service[/host]@REALM\", name);\n}","preventionTips":["Keep principals in canonical service[/instance]@REALM form in config files","Reject principal values containing more than one '@' at config-load time","Template principal values from validated variables instead of hand-editing"],"tags":["sasl","kerberos","configuration","input-validation"],"backgroundTag":"malformed-kerberos-principal","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}