{"record":{"id":"a4c0a31f978e2b1d","repo":"apache/hadoop","slug":"hadoop-security-authorizationis-configured-to-true","errorCode":null,"errorMessage":"hadoop.security.authorizationis configured to true but service-levelauthorization security policy is null.","messagePattern":"hadoop\\.security\\.authorizationis configured to true but service-levelauthorization security policy is null\\.","errorType":"validation","errorClass":"HadoopIllegalArgumentException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/ha/ZKFCRpcServer.java","lineNumber":68,"sourceCode":"      PolicyProvider policy) throws IOException {\n    this.zkfc = zkfc;\n    \n    RPC.setProtocolEngine(conf, ZKFCProtocolPB.class,\n        ProtobufRpcEngine2.class);\n    ZKFCProtocolServerSideTranslatorPB translator =\n        new ZKFCProtocolServerSideTranslatorPB(this);\n    BlockingService service = ZKFCProtocolService\n        .newReflectiveBlockingService(translator);\n    this.server = new RPC.Builder(conf).setProtocol(ZKFCProtocolPB.class)\n        .setInstance(service).setBindAddress(bindAddr.getHostName())\n        .setPort(bindAddr.getPort()).setNumHandlers(HANDLER_COUNT)\n        .setVerbose(false).build();\n    \n    // set service-level authorization security policy\n    if (conf.getBoolean(\n        CommonConfigurationKeys.HADOOP_SECURITY_AUTHORIZATION, false)) {\n      if (policy == null) {\n        throw new HadoopIllegalArgumentException(\n            CommonConfigurationKeys.HADOOP_SECURITY_AUTHORIZATION\n                + \"is configured to true but service-level\"\n                + \"authorization security policy is null.\");\n      }\n      server.refreshServiceAcl(conf, policy);\n    }\n\n  }\n  \n  void start() {\n    this.server.start();\n  }\n\n  public InetSocketAddress getAddress() {\n    return server.getListenerAddress();\n  }\n\n  void stopAndJoin() throws InterruptedException {","sourceCodeStart":50,"sourceCodeEnd":86,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/ha/ZKFCRpcServer.java#L50-L86","documentation":"ZKFCRpcServer's constructor throws HadoopIllegalArgumentException when hadoop.security.authorization is true but the PolicyProvider passed to the constructor is null, so server.refreshServiceAcl(conf, policy) cannot be called. It is a wiring error in how the ZKFC RPC server was constructed, not a normal runtime condition.","triggerScenarios":"Constructing new ZKFCRpcServer(conf, addr, null) while HADOOP_SECURITY_AUTHORIZATION is true in the Configuration; any code path or test harness that instantiates the server without supplying a service-ACL policy provider.","commonSituations":"Custom tooling embedding ZKFCRpcServer directly; unit tests with authorization on but no policy; running against a mixed-version classpath where the caller does not pass the ZKFCPolicyProvider.","solutions":["Pass a PolicyProvider when authorization is enabled — Hadoop wires its own (ZKFCPolicyProvider) in the normal daemon path; don't construct the server manually.","Or set hadoop.security.authorization=false in that Configuration if service-level ACLs are not intended for that server.","If embedding is required, construct with a non-null policy or a Configuration with authorization disabled before calling the constructor."],"exampleFix":"// before\nnew ZKFCRpcServer(conf, myAddr, null);\n\n// after: supply the policy when hadoop.security.authorization=true\nnew ZKFCRpcServer(conf, myAddr, new ZKFCPolicyProvider());\n// or disable service ACLs for this embedded server\nconf.setBoolean(CommonConfigurationKeys.HADOOP_SECURITY_AUTHORIZATION, false);","handlingStrategy":"validation","validationCode":"boolean authz = conf.getBoolean(\n    CommonConfigurationKeys.HADOOP_SECURITY_AUTHORIZATION, false);\nif (authz && policy == null) {\n  throw new IllegalStateException(\n      \"hadoop.security.authorization=true requires a non-null PolicyProvider\");\n}\nnew ZKFCRpcServer(conf, addr, authz ? policy : null);","typeGuard":null,"tryCatchPattern":"try {\n  new ZKFCRpcServer(conf, addr, policy);\n} catch (HadoopIllegalArgumentException e) {\n  // pass a PolicyProvider (e.g. ZKFCPolicyProvider) or disable\n  // hadoop.security.authorization for this embedded server\n}","preventionTips":["Do not construct ZKFCRpcServer by hand; use the standard ZKFC daemon entry point, which wires the policy provider.","In test harnesses, either disable service authorization or supply a minimal PolicyProvider.","Assert (authz == false) || (policy != null) in constructors of wrappers around RPC servers."],"tags":["hadoop","high-availability","zkfc","security","authorization"],"backgroundTag":"security-misconfiguration","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}