{"record":{"id":"72214317bb7ca18d","repo":"apache/hadoop","slug":"user-can-not-be-removed","errorCode":null,"errorMessage":"User {} can not be removed","messagePattern":"User (.+?) can not be removed","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/authorize/AccessControlList.java","lineNumber":187,"sourceCode":"      throw new IllegalArgumentException(\"Group \" + group + \" can not be added\");\n    }\n    if (!isAllAllowed()) {\n      List<String> groupsList = new LinkedList<String>();\n      groupsList.add(group);\n      groupsMapping.cacheGroupsAdd(groupsList);\n      groups.add(group);\n    }\n  }\n\n  /**\n   * Remove user from the names of users allowed for this service.\n   * \n   * @param user\n   *          The user name\n   */\n  public void removeUser(String user) {\n    if (isWildCardACLValue(user)) {\n      throw new IllegalArgumentException(\"User \" + user + \" can not be removed\");\n    }\n    if (!isAllAllowed()) {\n      users.remove(user);\n    }\n  }\n\n  /**\n   * Remove group from the names of groups allowed for this service.\n   * \n   * @param group\n   *          The group name\n   */\n  public void removeGroup(String group) {\n    if (isWildCardACLValue(group)) {\n      throw new IllegalArgumentException(\"Group \" + group\n          + \" can not be removed\");\n    }\n    if (!isAllAllowed()) {","sourceCodeStart":169,"sourceCodeEnd":205,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/authorize/AccessControlList.java#L169-L205","documentation":"AccessControlList.removeUser throws IllegalArgumentException when the user name is a wildcard ACL value (\"*\"). Removing a wildcard from the user set is undefined — an all-allowed ACL has an empty user set and the allAllowed flag — so the API refuses it.","triggerScenarios":"Calling removeUser(\"*\"); symmetrical update code that removes a set of configured tokens and encounters a wildcard; sync tools applying ACL diffs that include \"*\".","commonSituations":"ACL synchronization between config and AccessControlList objects; scripts that mirror removals from a policy file; test cleanup routines iterating over wildcard fixtures.","solutions":["Skip wildcard tokens before calling removeUser","If the intent is 'deny everyone', rebuild the ACL instead of removing entries from a wildcard one","Validate tokens against \"*\" at the boundary where ACL strings are parsed"],"exampleFix":"// before\nfor (String u : removedUsers) {\n  acl.removeUser(u); // throws if u == \"*\"\n}\n\n// after\nfor (String u : removedUsers) {\n  if (!\"*\".equals(u.trim())) {\n    acl.removeUser(u.trim());\n  }\n}","handlingStrategy":"validation","validationCode":"private static boolean isWildCardAclToken(String s) {\n  return s == null || s.trim().isEmpty() || \"*\".equals(s.trim());\n}\n\nfor (String u : removed) {\n  if (!isWildCardAclToken(u)) {\n    acl.removeUser(u.trim());\n  }\n}","typeGuard":null,"tryCatchPattern":"try {\n  acl.removeUser(user);\n} catch (IllegalArgumentException e) {\n  throw new ConfigException(\"Wildcard user token not allowed: \" + user, e);\n}","preventionTips":["Apply diff-based ACL updates only to concrete tokens","Rebuild ACLs from corrected strings rather than mutating wildcard ones","Share the wildcard guard across all four mutators"],"tags":["acl","authorization","hadoop","validation"],"backgroundTag":"invalid-acl-value","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}