{"record":{"id":"82f806cddb47a208","repo":"apache/pulsar","slug":"invalid-rule-remaining","errorCode":null,"errorMessage":"Invalid rule: remaining","messagePattern":"Invalid rule: remaining","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"pulsar-common/src/main/java/org/apache/pulsar/common/sasl/KerberosName.java","lineNumber":346,"sourceCode":"                        result = replaceSubstitution(base, fromPattern, toPattern,  repeat);\n                    }\n                }\n            }\n            if (result != null && nonSimplePattern.matcher(result).find()) {\n                throw new NoMatchingRule(\"Non-simple name \" + result\n                    + \" after auth_to_local rule \" + this);\n            }\n            return result;\n        }\n    }\n\n    static List<Rule> parseRules(String rules) {\n        List<Rule> result = new ArrayList<Rule>();\n        String remaining = rules.trim();\n        while (remaining.length() > 0) {\n            Matcher matcher = ruleParser.matcher(remaining);\n            if (!matcher.lookingAt()) {\n                throw new IllegalArgumentException(\"Invalid rule: \" + remaining);\n            }\n            if (matcher.group(2) != null) {\n                result.add(new Rule());\n            } else {\n                result.add(new Rule(Integer.parseInt(matcher.group(4)),\n                    matcher.group(5),\n                    matcher.group(7),\n                    matcher.group(9),\n                    matcher.group(10),\n                    \"g\".equals(matcher.group(11))));\n            }\n            remaining = remaining.substring(matcher.end());\n        }\n        return result;\n    }\n\n    /**\n     * Set the static configuration to get the rules.","sourceCodeStart":328,"sourceCodeEnd":364,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-common/src/main/java/org/apache/pulsar/common/sasl/KerberosName.java#L328-L364","documentation":"KerberosName.parseRules compiles the Hadoop-style auth_to_local rule string into Rule objects. Each rule must begin with a token matching the ruleParser regex (RULE:[n:string](regex)srepl or DEFAULT); otherwise the unparseable remaining substring is rejected with IllegalArgumentException.","triggerScenarios":"Calling KerberosName.setConfiguration/parseRules with a rules string containing a malformed rule, e.g. 'RULE:[1:$1@$0](.*)DEFAULT bogus' or a rule missing its '[n:s]' bracketed section.","commonSituations":"Hand-edited auth_to_local rules in Pulsar SASL config; rules copied from Hadoop docs with missing brackets or case-flag typos; stray whitespace-split tokens trailing the valid rules.","solutions":["Correct the rule string so every rule is 'RULE:[n:string](regexp)sreplacement' or 'DEFAULT'","Validate each token starts with RULE: or equals DEFAULT before applying the config","Fix or remove the offending trailing token named in the message","Start with a minimal 'DEFAULT' string and add rules incrementally"],"exampleFix":"// before\nKerberosName.setConfiguration(\"RULE:[1:$1@$0](.*)DEFAULT bogus\");\n// after\nKerberosName.setConfiguration(\"RULE:[1:$1@$0](.*)DEFAULT\");","handlingStrategy":"validation","validationCode":"static void validateAuthToLocal(String rules) {\n    for (String token : rules.trim().split(\"\\\\s+\")) {\n        if (!token.equals(\"DEFAULT\") && !token.startsWith(\"RULE:\")) {\n            throw new IllegalArgumentException(\"Invalid rule: \" + token);\n        }\n    }\n}","typeGuard":null,"tryCatchPattern":"try {\n    KerberosName.setConfiguration(rules);\n} catch (IllegalArgumentException e) {\n    log.error(\"auth_to_local rejected: {}\", e.getMessage());\n}","preventionTips":["Test rule strings with a minimal 'DEFAULT' first, then add rules incrementally","Lint rules for RULE:/DEFAULT tokens and balanced brackets before applying configuration","Keep the rules string on one line without stray tokens"],"tags":["sasl","kerberos","configuration","regex"],"backgroundTag":"invalid-auth-to-local-rule","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}