{"record":{"id":"a2342a96d05e7d83","repo":"apache/hadoop","slug":"group-can-not-be-removed","errorCode":null,"errorMessage":"Group {} can not be removed","messagePattern":"Group (.+?) can not be removed","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/authorize/AccessControlList.java","lineNumber":202,"sourceCode":"   */\n  public void removeUser(String user) {\n    if (isWildCardACLValue(user)) {\n      throw new IllegalArgumentException(\"User \" + user + \" can not be removed\");\n    }\n    if (!isAllAllowed()) {\n      users.remove(user);\n    }\n  }\n\n  /**\n   * Remove group from the names of groups allowed for this service.\n   * \n   * @param group\n   *          The group name\n   */\n  public void removeGroup(String group) {\n    if (isWildCardACLValue(group)) {\n      throw new IllegalArgumentException(\"Group \" + group\n          + \" can not be removed\");\n    }\n    if (!isAllAllowed()) {\n      groups.remove(group);\n    }\n  }\n\n  /**\n   * Get the names of users allowed for this service.\n   * @return the set of user names. the set must not be modified.\n   */\n  public Collection<String> getUsers() {\n    return users;\n  }\n  \n  /**\n   * Get the names of user groups allowed for this service.\n   * @return the set of group names. the set must not be modified.","sourceCodeStart":184,"sourceCodeEnd":220,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/authorize/AccessControlList.java#L184-L220","documentation":"AccessControlList.removeGroup throws IllegalArgumentException when the group name is a wildcard ACL value (\"*\"). Same rule as the other mutators: wildcard is an ACL-level construct, not a removable entry, so removeGroup rejects it.","triggerScenarios":"Calling removeGroup(\"*\"); diff-driven group removal code that walks tokens from an ACL string; cleanup paths after addGroup-based construction.","commonSituations":"Tools that keep AccessControlList objects in sync with policy files; removing groups from ACLs that were built from wildcard strings.","solutions":["Skip wildcard tokens before calling removeGroup","Rebuild the ACL from a corrected string instead of mutating a wildcard ACL","Add a shared guard (isWildCardACLValue-style check) around all ACL mutation call sites"],"exampleFix":"// before\nfor (String g : removedGroups) {\n  acl.removeGroup(g); // throws if g == \"*\"\n}\n\n// after\nfor (String g : removedGroups) {\n  if (!\"*\".equals(g.trim())) {\n    acl.removeGroup(g.trim());\n  }\n}","handlingStrategy":"validation","validationCode":"private static boolean isWildCardAclToken(String s) {\n  return s == null || s.trim().isEmpty() || \"*\".equals(s.trim());\n}\n\nfor (String g : removed) {\n  if (!isWildCardAclToken(g)) {\n    acl.removeGroup(g.trim());\n  }\n}","typeGuard":null,"tryCatchPattern":"try {\n  acl.removeGroup(group);\n} catch (IllegalArgumentException e) {\n  throw new ConfigException(\"Wildcard group token not allowed: \" + group, e);\n}","preventionTips":["Filter tokens before removal loops","Prefer immutable ACL reconstruction over incremental mutation of policy-driven ACLs","Test remove paths with wildcard fixtures"],"tags":["acl","authorization","hadoop","groups","validation"],"backgroundTag":"invalid-acl-value","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}