{"record":{"id":"49d3ab87f7166ff4","repo":"apache/hadoop","slug":"invalid-rule-remaining","errorCode":null,"errorMessage":"Invalid rule: ${remaining}","messagePattern":"Invalid rule: (.+?)","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/util/KerberosName.java","lineNumber":364,"sourceCode":"              && nonSimplePattern.matcher(result).find()\n              && ruleMechanism.equalsIgnoreCase(MECHANISM_HADOOP)) {\n        throw new NoMatchingRule(\"Non-simple name \" + result +\n                                 \" after auth_to_local rule \" + this);\n      }\n      if (toLowerCase && result != null) {\n        result = result.toLowerCase(Locale.ENGLISH);\n      }\n      return result;\n    }\n  }\n\n  static List<Rule> parseRules(String rules) {\n    List<Rule> result = new ArrayList<Rule>();\n    String remaining = rules.trim();\n    while (remaining.length() > 0) {\n      Matcher matcher = ruleParser.matcher(remaining);\n      if (!matcher.lookingAt()) {\n        throw new IllegalArgumentException(\"Invalid rule: \" + remaining);\n      }\n      if (matcher.group(2) != null) {\n        result.add(new Rule());\n      } else {\n        result.add(new Rule(Integer.parseInt(matcher.group(4)),\n                            matcher.group(5),\n                            matcher.group(7),\n                            matcher.group(9),\n                            matcher.group(10),\n                            \"g\".equals(matcher.group(11)),\n                            \"L\".equals(matcher.group(12))));\n      }\n      remaining = remaining.substring(matcher.end());\n    }\n    return result;\n  }\n\n  @SuppressWarnings(\"serial\")","sourceCodeStart":346,"sourceCodeEnd":382,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/util/KerberosName.java#L346-L382","documentation":"KerberosName.parseRules() compiles the hadoop.security.auth_to_local rule list. Each rule must match the 'RULE:[n:format](regex)replacement[/L]' syntax; if a chunk of the rules string cannot be consumed by the rule parser, the leftover text is thrown back inside IllegalArgumentException('Invalid rule: ...'), naming exactly where parsing stopped.","triggerScenarios":"Loading core-site.xml where auth_to_local contains a typo: 'RULE:[1:$1@$0](.*)L' with unbalanced parentheses, a missing '[n:format]' section, misspelled 'RULE' prefix, or stray separators so the remainder fails to match.","commonSituations":"Hand-edited auth_to_local rules in core-site.xml; rules copied from MIT krb5 documentation without adapting to Hadoop's RULE syntax; missing the optional '/L' or adding an invalid suffix.","solutions":["Read the text after 'Invalid rule:' in the error — it is the exact position where parsing stopped, then fix that rule in auth_to_local","Check every rule against 'RULE:[<n>:<format>](<regex>)<replacement>[/L]' with balanced brackets and parentheses","Test the corrected config with 'hadoop org.apache.hadoop.security.HadoopKerberosName user@REALM' before restarting services"],"exampleFix":"<!-- before -->\n<property><name>hadoop.security.auth_to_local</name>\n<value>RULE:[1:$1@$0](*.)L</value></property>\n\n<!-- after -->\n<property><name>hadoop.security.auth_to_local</name>\n<value>RULE:[1:$1@$0](.*)L</value></property>","handlingStrategy":"validation","validationCode":"// smoke-test rules before deploying config\njava.util.List<?> unused = org.apache.hadoop.security.HadoopKerberosName.getRules();\n// or run: hadoop org.apache.hadoop.security.HadoopKerberosName 'user@REALM'\n// a malformed rule throws IllegalArgumentException('Invalid rule: ...') immediately","typeGuard":null,"tryCatchPattern":"try { KerberosName.setRules(rulesString); } catch (IllegalArgumentException e) { /* e.getMessage() pinpoints the failing remainder; fix core-site.xml and redeploy */ }","preventionTips":["Validate every RULE line against RULE:[n:fmt](regex)replacement[/L] in review","Use HadoopKerberosName CLI to test rules before restarting services","Keep rules one-per-line to make the failing remainder obvious"],"tags":["kerberos","configuration","auth-to-local","startup"],"backgroundTag":"auth-to-local-rule-invalid","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}