{"record":{"id":"5c4d6abb35685e06","repo":"apache/hadoop","slug":"invalid-uid-could-not-determine-effective-user","errorCode":null,"errorMessage":"Invalid UID, could not determine effective user","messagePattern":"Invalid UID, could not determine effective user","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/UserGroupInformation.java","lineNumber":2080,"sourceCode":"    try {\n      HadoopLoginContext login = newLoginContext(\n        authenticationMethod.getLoginAppName(), subject, loginConf);\n      login.login();\n      UserGroupInformation ugi = new UserGroupInformation(login.getSubject());\n      // attach login context for relogin unless this was a pre-existing\n      // subject.\n      if (subject == null) {\n        params.put(LoginParam.PRINCIPAL, ugi.getUserName());\n        ugi.setLogin(login);\n        ugi.setLastLogin(Time.now());\n      }\n      return ugi;\n    } catch (LoginException le) {\n      String msg = le.getMessage();\n      if (msg != null && msg.contains(\"invalid null input\")) {\n        // This error from the JDK indicates that the OS couldn't map the UID of this process to an\n        // actual user. Throw this as an IOException, because it's not related to Kerberos.\n        throw new IOException(INVALID_UID, le);\n      }\n      KerberosAuthException kae =\n        new KerberosAuthException(FAILURE_TO_LOGIN, le);\n      if (params != null) {\n        kae.setPrincipal(params.get(LoginParam.PRINCIPAL));\n        kae.setKeytabFile(params.get(LoginParam.KEYTAB));\n        kae.setTicketCacheFile(params.get(LoginParam.CCACHE));\n      }\n      throw kae;\n    }\n  }\n\n  // parameters associated with kerberos logins.  may be extended to support\n  // additional authentication methods.\n  enum LoginParam {\n    PRINCIPAL,\n    KEYTAB,\n    CCACHE,","sourceCodeStart":2062,"sourceCodeEnd":2098,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/UserGroupInformation.java#L2062-L2098","documentation":"During login, the JDK's UnixLoginModule can fail with 'invalid null input' when the OS cannot map the current process UID to a user (getpwuid found nothing). UGI detects that message and rethrows it as IOException('Invalid UID, could not determine effective user') because the failure is OS-level, not Kerberos.","triggerScenarios":"doSubjectLogin/loginUserFromKeytab running in a process whose numeric UID has no entry in /etc/passwd (or the NSS passwd source) - typical of containers/schedulers launching JVMs as arbitrary unreferenced UIDs.","commonSituations":"Docker/Kubernetes pods running as a random numeric UID (OpenShift-style) without a passwd entry; nsswitch.conf not consulting the right passwd source; LDAP-managed passwd entries unreachable at login time.","solutions":["Give the runtime UID a passwd entry on the host: `useradd -o -u <uid> -g <gid> <name>` (or maintain it via LDAP/nss)","In containers, inject the user into /etc/passwd at entrypoint (echo \"user:x:$(id -u):$(id -g)::/:/bin/bash\" >> /etc/passwd)","Run the JVM as an existing registered user instead of an arbitrary UID","Verify with `getent passwd $(id -u)` on the node before starting Hadoop processes"],"exampleFix":"# before: container runs as unreferenced UID 1002321\n# after: entrypoint ensures a passwd entry exists\necho \"hadoop:x:$(id -u):$(id -g)::/home/hadoop:/bin/bash\" >> /etc/passwd\nexec \"$@\"","handlingStrategy":"validation","validationCode":"// Fail fast when the process UID has no passwd entry\nif (java.nio.file.Files.lines(java.nio.file.Paths.get(\"/etc/passwd\"))\n        .noneMatch(l -> l.startsWith(\"^[^:]*:\" + System.getProperty(\"user.name\")))) {\n  // simpler robust check below\n}\nString uid = String.valueOf(com.sun.security.auth.module.UnixSystem.class\n    == null ? -1 : new com.sun.security.auth.module.UnixSystem().getUid());\njava.util.Scanner s = new java.util.Scanner(Runtime.getRuntime()\n    .exec(new String[]{\"getent\", \"passwd\", uid}).getInputStream())\n    .useDelimiter(\"\\\\A\");\nif (!s.hasNext()) {\n  throw new IllegalStateException(\"UID \" + uid + \" has no passwd entry\");\n}","typeGuard":null,"tryCatchPattern":"try {\n  UserGroupInformation.loginUserFromKeytab(principal, keytab);\n} catch (IOException e) {\n  if (e.getMessage() != null\n      && e.getMessage().contains(\"Invalid UID\")) {\n    throw new IllegalStateException(\n        \"process UID is not mapped in /etc/passwd - add a passwd entry\", e);\n  }\n  throw e;\n}","preventionTips":["Ensure every node/container running Hadoop JVMs has a passwd entry for the runtime UID","In containers, append the UID to /etc/passwd in the entrypoint","Verify with `getent passwd $(id -u)` in health checks"],"tags":["hadoop","ugi","login","unix","uid","container"],"backgroundTag":"uid-not-in-passwd","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}