{"record":{"id":"8e178df5287ef7d3","repo":"apache/hadoop","slug":"group-can-not-be-added","errorCode":null,"errorMessage":"Group {} can not be added","messagePattern":"Group (.+?) can not be added","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/authorize/AccessControlList.java","lineNumber":169,"sourceCode":"   */\n  public void addUser(String user) {\n    if (isWildCardACLValue(user)) {\n      throw new IllegalArgumentException(\"User \" + user + \" can not be added\");\n    }\n    if (!isAllAllowed()) {\n      users.add(user);\n    }\n  }\n\n  /**\n   * Add group to the names of groups allowed for this service.\n   * \n   * @param group\n   *          The group name\n   */\n  public void addGroup(String group) {\n    if (isWildCardACLValue(group)) {\n      throw new IllegalArgumentException(\"Group \" + group + \" can not be added\");\n    }\n    if (!isAllAllowed()) {\n      List<String> groupsList = new LinkedList<String>();\n      groupsList.add(group);\n      groupsMapping.cacheGroupsAdd(groupsList);\n      groups.add(group);\n    }\n  }\n\n  /**\n   * Remove user from the names of users allowed for this service.\n   * \n   * @param user\n   *          The user name\n   */\n  public void removeUser(String user) {\n    if (isWildCardACLValue(user)) {\n      throw new IllegalArgumentException(\"User \" + user + \" can not be removed\");","sourceCodeStart":151,"sourceCodeEnd":187,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/authorize/AccessControlList.java#L151-L187","documentation":"AccessControlList.addGroup throws IllegalArgumentException when the group name is a wildcard ACL value (\"*\"). As with users, a wildcard cannot be a single group entry; it is only valid as a whole-ACL string. addGroup also caches the group via groupsMapping.cacheGroupsAdd, which a wildcard would corrupt.","triggerScenarios":"Calling addGroup(\"*\"); splitting an ACL string such as \"* \" and routing the wildcard token into addGroup; reusing parsers that pass through \"*\" from configuration.","commonSituations":"Programmatic ACL assembly from config fragments; tools that mirror service ACLs into AccessControlList objects; tests using wildcard fixtures.","solutions":["Filter wildcard tokens before calling addGroup (token.equals(\"*\"))","Construct wildcard ACLs directly: new AccessControlList(\"*\")","Reject wildcard entries in upstream validation of group lists"],"exampleFix":"// before\nfor (String g : groupsFromConfig) {\n  acl.addGroup(g); // throws if g == \"*\"\n}\n\n// after\nfor (String g : groupsFromConfig) {\n  if (!\"*\".equals(g.trim())) {\n    acl.addGroup(g.trim());\n  }\n}","handlingStrategy":"validation","validationCode":"private static boolean isWildCardAclToken(String s) {\n  return s == null || s.trim().isEmpty() || \"*\".equals(s.trim());\n}\n\nfor (String g : tokens) {\n  if (!isWildCardAclToken(g)) {\n    acl.addGroup(g.trim());\n  }\n}","typeGuard":null,"tryCatchPattern":"try {\n  acl.addGroup(group);\n} catch (IllegalArgumentException e) {\n  throw new ConfigException(\"Wildcard group token not allowed: \" + group, e);\n}","preventionTips":["Parse complete ACL strings with the AccessControlList constructor instead of token-by-token mutation","Reject wildcard group tokens during config validation","Unit-test ACL builders with \"*\" inputs to fail fast at build time"],"tags":["acl","authorization","hadoop","groups","validation"],"backgroundTag":"invalid-acl-value","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}