{"record":{"id":"7010f43b51e76dfa","repo":"apache/hadoop","slug":"user-can-not-be-added","errorCode":null,"errorMessage":"User {} can not be added","messagePattern":"User (.+?) can not be added","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/authorize/AccessControlList.java","lineNumber":154,"sourceCode":"        aclString.trim().equals(WILDCARD_ACL_VALUE)) {\n      return true;\n    }\n    return false;\n  }\n\n  public boolean isAllAllowed() {\n    return allAllowed;\n  }\n  \n  /**\n   * Add user to the names of users allowed for this service.\n   * \n   * @param user\n   *          The user name\n   */\n  public void addUser(String user) {\n    if (isWildCardACLValue(user)) {\n      throw new IllegalArgumentException(\"User \" + user + \" can not be added\");\n    }\n    if (!isAllAllowed()) {\n      users.add(user);\n    }\n  }\n\n  /**\n   * Add group to the names of groups allowed for this service.\n   * \n   * @param group\n   *          The group name\n   */\n  public void addGroup(String group) {\n    if (isWildCardACLValue(group)) {\n      throw new IllegalArgumentException(\"Group \" + group + \" can not be added\");\n    }\n    if (!isAllAllowed()) {\n      List<String> groupsList = new LinkedList<String>();","sourceCodeStart":136,"sourceCodeEnd":172,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/authorize/AccessControlList.java#L136-L172","documentation":"AccessControlList.addUser throws IllegalArgumentException when the argument is a wildcard ACL value (i.e. \"*\"). Wildcards only make sense for a whole ACL string (new AccessControlList(\"*\")); they are meaningless as a single entry in the user set, so incremental addition rejects them.","triggerScenarios":"Calling addUser(\"*\") or feeding tokens split from an ACL string like \"* \" into addUser; test code using \"*\" as a placeholder user; config parsers that pass raw ACL fragments to the programmatic API.","commonSituations":"Code that splits a configured ACL string on whitespace/commas and adds each token; porting XML ACL values into the Java API; sharing one builder for ACLs that are sometimes wildcard.","solutions":["Skip wildcard tokens before calling addUser (check token.equals(\"*\"))","Build wildcard ACLs in one shot with the constructor: new AccessControlList(\"*\") instead of incremental adds","Validate ACL input at the config boundary and reject \"*\" in lists that will be added entry-by-entry"],"exampleFix":"// before\nfor (String u : usersFromConfig) {\n  acl.addUser(u); // throws if u == \"*\"\n}\n\n// after\nfor (String u : usersFromConfig) {\n  if (!\"*\".equals(u.trim())) {\n    acl.addUser(u.trim());\n  }\n}","handlingStrategy":"validation","validationCode":"private static boolean isWildCardAclToken(String s) {\n  return s == null || s.trim().isEmpty() || \"*\".equals(s.trim());\n}\n\nfor (String u : tokens) {\n  if (!isWildCardAclToken(u)) {\n    acl.addUser(u.trim());\n  }\n}","typeGuard":null,"tryCatchPattern":"try {\n  acl.addUser(user);\n} catch (IllegalArgumentException e) {\n  // log and reject the offending ACL input, do not silently continue\n  throw new ConfigException(\"Wildcard user token not allowed: \" + user, e);\n}","preventionTips":["Prefer building ACLs once from the full string via new AccessControlList(aclString)","Validate policy strings at load time and reject \"*\" inside token lists","Keep one shared wildcard-check helper for all addUser/addGroup/removeUser/removeGroup call sites"],"tags":["acl","authorization","hadoop","validation"],"backgroundTag":"invalid-acl-value","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}