{"record":{"id":"96aa8acb84accf12","repo":"apache/hadoop","slug":"auth-not-of-expected-form-scheme-auth","errorCode":null,"errorMessage":"Auth '{}' not of expected form scheme:auth","messagePattern":"Auth '(.+?)' not of expected form scheme:auth","errorType":"exception","errorClass":"BadAuthFormatException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/util/ZKUtil.java","lineNumber":147,"sourceCode":"   * @param authString the comma-separated auth mechanisms\n   * @return a list of parsed authentications\n   * @throws BadAuthFormatException if the auth format is invalid\n   */\n  public static List<ZKAuthInfo> parseAuth(String authString) throws\n      BadAuthFormatException{\n    List<ZKAuthInfo> ret = Lists.newArrayList();\n    if (authString == null) {\n      return ret;\n    }\n    \n    List<String> authComps = Lists.newArrayList(\n        Splitter.on(',').omitEmptyStrings().trimResults()\n        .split(authString));\n    \n    for (String comp : authComps) {\n      String parts[] = comp.split(\":\", 2);\n      if (parts.length != 2) {\n        throw new BadAuthFormatException(\n            \"Auth '\" + comp + \"' not of expected form scheme:auth\");\n      }\n      ret.add(new ZKAuthInfo(parts[0],\n          parts[1].getBytes(StandardCharsets.UTF_8)));\n    }\n    return ret;\n  }\n  \n  /**\n   * Because ZK ACLs and authentication information may be secret,\n   * allow the configuration values to be indirected through a file\n   * by specifying the configuration as \"@/path/to/file\". If this\n   * syntax is used, this function will return the contents of the file\n   * as a String.\n   * \n   * @param valInConf the value from the Configuration \n   * @return either the same value, or the contents of the referenced\n   * file if the configured value starts with \"@\"","sourceCodeStart":129,"sourceCodeEnd":165,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/util/ZKUtil.java#L129-L165","documentation":"ZKUtil.stringToAuth splits each comma-separated auth entry on ':' with a limit of 2, expecting 'scheme:auth'. If an entry contains no colon at all, the split yields a single-element array and the method throws BadAuthFormatException (a HadoopIllegalArgumentException) with this message. With the limit-2 split, 'digest:user:pass' is fine — everything after the first colon is the auth blob — but 'digest' alone is not.","triggerScenarios":"ZKUtil.stringToAuths(\"digest\") — scheme only; \"kerberos\" without a principal; \"digest:user@realm\" intended as credential but missing ':pass' is actually fine ('user@realm' becomes the auth blob) while \"digest:\" is fine too (empty auth); the failing case is strictly zero colons.","commonSituations":"ZooKeeper auth configuration (e.g. YARN registry 'hadoop.registry.zk.auth') written as a bare scheme; auth entries assembled from variables where the separator or credential part was lost; using '@file' indirection syntax inside the wrong property instead of as the whole value.","solutions":["Format every entry as scheme:auth, e.g. \"digest:user:password\" or \"kerberos:user@REALM\".","Fix the auth config property so each comma-separated entry contains a colon.","Pre-validate entries with ^[^:]+:.+$ before calling stringToAuths.","Catch BadAuthFormatException at config load and name the offending entry."],"exampleFix":"// before\nList<ZKAuthInfo> auth = ZKUtil.stringToAuths(\"digest\");\n// throws: Auth 'digest' not of expected form scheme:auth\n\n// after\nList<ZKAuthInfo> auth = ZKUtil.stringToAuths(\"digest:alice:secret\");","handlingStrategy":"validation","validationCode":"private static final Pattern AUTH_ENTRY =\n    Pattern.compile(\"^[^:,]+:.+$\");\n\nstatic void validateAuthString(String auth) {\n  for (String entry : auth.split(\",\")) {\n    if (!AUTH_ENTRY.matcher(entry).matches()) {\n      throw new IllegalArgumentException(\n          \"Auth entry '\" + entry + \"' must be scheme:auth\");\n    }\n  }\n}\n\nvalidateAuthString(authConf); // before ZKUtil.stringToAuths","typeGuard":null,"tryCatchPattern":"try {\n  auths = ZKUtil.stringToAuths(authString);\n} catch (ZKUtil.BadAuthFormatException e) {\n  throw new ConfigurationException(\"Bad zk auth config: \" + e.getMessage(), e);\n}","preventionTips":["Template zk auth values as scheme:auth (digest:user:pass, kerberos:principal).","Validate auth config at startup with a scheme:auth regex.","Never assume a bare scheme name is accepted; the colon separator is mandatory."],"tags":["zookeeper","authentication","configuration","validation","hadoop-common"],"backgroundTag":"zookeeper-auth-malformed","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}