{"record":{"id":"3e457ebf44745f7a","repo":"apache/hadoop","slug":"no-user-for-acls-determinable-from-current-user-or","errorCode":null,"errorMessage":"No user for ACLs determinable from current user or registry option hadoop.registry.user.accounts","messagePattern":"No user for ACLs determinable from current user or registry option hadoop\\.registry\\.user\\.accounts","errorType":"exception","errorClass":"ServiceStateException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-registry/src/main/java/org/apache/hadoop/registry/client/impl/zk/RegistrySecurity.java","lineNumber":291,"sourceCode":"            throw new IOException(\"Kerberos required for secure registry access\");\n          }\n          UserGroupInformation currentUser =\n              UserGroupInformation.getCurrentUser();\n          jaasClientEntry = getOrFail(KEY_REGISTRY_CLIENT_JAAS_CONTEXT,\n              DEFAULT_REGISTRY_CLIENT_JAAS_CONTEXT);\n          jaasClientIdentity = currentUser.getShortUserName();\n          if (LOG.isDebugEnabled()) {\n            LOG.debug(\"Auth is SASL user=\\\"{}\\\" JAAS context=\\\"{}\\\"\",\n                jaasClientIdentity, jaasClientEntry);\n          }\n          break;\n\n        case digest:\n          String id = getOrFail(KEY_REGISTRY_CLIENT_AUTHENTICATION_ID, \"\");\n          String pass = getOrFail(KEY_REGISTRY_CLIENT_AUTHENTICATION_PASSWORD, \"\");\n          if (userACLs.isEmpty()) {\n            //\n            throw new ServiceStateException(E_NO_USER_DETERMINED_FOR_ACLS);\n          }\n          digest(id, pass);\n          ACL acl = new ACL(ZooDefs.Perms.ALL, toDigestId(id, pass));\n          userACLs.add(acl);\n          digestAuthUser = id;\n          digestAuthPassword = pass;\n          String authPair = id + \":\" + pass;\n          digestAuthData = authPair.getBytes(StandardCharsets.UTF_8);\n          if (LOG.isDebugEnabled()) {\n            LOG.debug(\"Auth is Digest ACL: {}\", aclToString(acl));\n          }\n          break;\n\n        case anon:\n        case simple:\n          // nothing is needed; account is read only.\n          if (LOG.isDebugEnabled()) {\n            LOG.debug(\"Auth is anonymous\");","sourceCodeStart":273,"sourceCodeEnd":309,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-registry/src/main/java/org/apache/hadoop/registry/client/impl/zk/RegistrySecurity.java#L273-L309","documentation":"In digest mode RegistrySecurity builds the user ACL list from an optional self-ACL derived from the current UGI user plus the comma-separated hadoop.registry.user.accounts option. If that list ends up empty, no principal would be granted rights on created nodes — the nodes could become inaccessible — so initSecurity throws ServiceStateException with E_NO_USER_DETERMINED_FOR_ACLS ('No user for ACLs determinable from current user or registry option hadoop.registry.user.accounts').","triggerScenarios":"client.auth=digest with hadoop.registry.user.accounts unset or empty and createSaslACLFromCurrentUser returning null (no derivable user), i.e. only id/password configured but no accounts to own the created nodes.","commonSituations":"Digest-auth setups where only auth.id/auth.password were configured and the accounts option was forgotten; running under a UGI whose short username cannot be determined; minimal test configs copied from docs.","solutions":["Set hadoop.registry.user.accounts to the account names that should receive ACL entries (e.g. 'registry,alice').","Verify via RegistryOperationsFactory.createAuthenticatedInstance(id, password, ...) plus explicit user accounts in the configuration.","If Kerberos infrastructure exists, prefer client.auth=kerberos where the self-ACL is derived from the logged-in user automatically."],"exampleFix":"// before\nconf.set(\"hadoop.registry.client.auth\", \"digest\");\nconf.set(\"hadoop.registry.client.auth.id\", \"registry\");\nconf.set(\"hadoop.registry.client.auth.password\", \"secret\");\n// hadoop.registry.user.accounts unset -> E_NO_USER_DETERMINED_FOR_ACLS\n\n// after\nconf.set(\"hadoop.registry.user.accounts\", \"registry,alice\");","handlingStrategy":"validation","validationCode":"if (\"digest\".equals(conf.get(\"hadoop.registry.client.auth\", \"\"))\n    && StringUtils.isEmpty(conf.get(\"hadoop.registry.user.accounts\", \"\"))) {\n  conf.set(\"hadoop.registry.user.accounts\", System.getProperty(\"user.name\"));\n  // or fail fast with a clear message naming hadoop.registry.user.accounts\n}","typeGuard":null,"tryCatchPattern":"try {\n  RegistryOperations ops = RegistryOperationsFactory.createAuthenticatedInstance(conf, id, pass, null);\n} catch (ServiceStateException e) {\n  // E_NO_USER_DETERMINED_FOR_ACLS: set hadoop.registry.user.accounts and retry\n}","preventionTips":["When configuring digest auth, always set hadoop.registry.user.accounts alongside auth.id/auth.password.","Prefer kerberos auth where a self-ACL is derived from the logged-in user automatically.","Add a config checklist item for digest setups: id, password, and user accounts must all be present."],"tags":["registry","acl","digest-auth","configuration","hadoop-registry"],"backgroundTag":"zookeeper-acl-setup","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}