{"record":{"id":"8c33db1cb944aaa9","repo":"apache/hadoop","slug":"usernames-not-matched-name-shortname-expecte","errorCode":null,"errorMessage":"Usernames not matched: name={shortName} != expected={expected}","messagePattern":"Usernames not matched: name=(.+?) != expected=(.+?)","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/common/JspHelper.java","lineNumber":220,"sourceCode":"    return request.getRemotePort();\n  }\n\n  /**\n   * Expected user name should be a short name.\n   */\n  public static void checkUsername(final String expected, final String name\n      ) throws IOException {\n    if (expected == null && name != null) {\n      throw new IOException(\"Usernames not matched: expecting null but name=\"\n          + name);\n    }\n    if (name == null) { //name is optional, null is okay\n      return;\n    }\n    KerberosName u = new KerberosName(name);\n    String shortName = u.getShortName();\n    if (!shortName.equals(expected)) {\n      throw new IOException(\"Usernames not matched: name=\" + shortName\n          + \" != expected=\" + expected);\n    }\n  }\n\n  private static String getUsernameFromQuery(final HttpServletRequest request,\n      final boolean tryUgiParameter) {\n    String username = request.getParameter(UserParam.NAME);\n    if (username == null && tryUgiParameter) {\n      //try ugi parameter\n      final String ugiStr = request.getParameter(\"ugi\");\n      if (ugiStr != null) {\n        username = ugiStr.split(\",\")[0];\n      }\n    }\n    return username;\n  }\n\n}","sourceCodeStart":202,"sourceCodeEnd":238,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/common/JspHelper.java#L202-L238","documentation":"The second branch of JspHelper.checkUsername: when both names exist, 'name' is normalized through KerberosName.getShortName() (applying hadoop auth_to_local rules) and compared to 'expected'; any difference throws IOException('Usernames not matched: name=X != expected=Y'). In DataNodeUGIProvider (line 146) the token owner's short name is expected, and the user.name query parameter is the name being checked, so a user.name that disagrees with the delegation token's identity is refused.","triggerScenarios":"Secured DataNode WebHDFS request whose delegation token belongs to user A but whose user.name parameter says user B after short-name rules (e.g., token for alice@REALM -> 'alice' vs user.name=bob); or auth_to_local rule changes that make the same principal's short name differ from what the client sends.","commonSituations":"Client libraries or browsers appending a stale user.name to DataNode URLs; auth_to_local rules changed after tokens were issued; cross-realm principals whose short-name mapping differs between client and cluster.","solutions":["Remove or correct the user.name parameter so it equals the token owner's short name (or simply omit it)","After changing hadoop.security.auth_to_local, re-kinit and obtain new delegation tokens so identities agree","Standardize on token/SPNEGO identity and stop sending user.name in secured deployments"],"exampleFix":"# before: token owner is alice, url says bob\ncurl 'http://dn:9864/webhdfs/v1/f?op=OPEN&delegation=<token>&user.name=bob'\n\n# after\ncurl 'http://dn:9864/webhdfs/v1/f?op=OPEN&delegation=<token>'","handlingStrategy":"try-catch","validationCode":"String expected = tokenUgi.getShortUserName();\nString name = request.getParameter(UserParam.NAME);\nif (name != null && expected != null) {\n  String shortName = new KerberosName(name).getShortName();\n  if (!shortName.equals(expected)) {\n    resp.sendError(403, \"user.name \" + shortName + \" != token owner \" + expected);\n    return;\n  }\n}","typeGuard":null,"tryCatchPattern":"try {\n  JspHelper.checkUsername(ugi.getShortUserName(), usernameFromQuery);\n} catch (IOException e) {\n  if (e.getMessage().startsWith(\"Usernames not matched:\")) {\n    resp.sendError(403, \"supplied user.name does not match the authenticated identity\");\n  } else throw e;\n}","preventionTips":["Strip user.name from client URLs once Kerberos is enabled","After changing auth_to_local rules, re-issue delegation tokens so short names agree","Log both sides of the comparison on mismatch to catch rule-mapping drift quickly"],"tags":["hdfs","webhdfs","datanode","delegation-token","kerberos","username-mismatch"],"backgroundTag":"username-mismatch","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}