{"record":{"id":"ad939d5f7740a59e","repo":"apache/hadoop","slug":"acl-not-of-expected-form-scheme-id-perm","errorCode":null,"errorMessage":"ACL '{}' not of expected form scheme:id:perm","messagePattern":"ACL '(.+?)' not of expected form scheme:id:perm","errorType":"exception","errorClass":"BadAclFormatException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/util/ZKUtil.java","lineNumber":110,"sourceCode":"   * @return ACL list\n   * @throws BadAclFormatException if an ACL is invalid\n   */\n  public static List<ACL> parseACLs(String aclString) throws\n      BadAclFormatException {\n    List<ACL> acl = Lists.newArrayList();\n    if (aclString == null) {\n      return acl;\n    }\n    \n    List<String> aclComps = Lists.newArrayList(\n        Splitter.on(',').omitEmptyStrings().trimResults()\n        .split(aclString));\n    for (String a : aclComps) {\n      // from ZooKeeperMain private method\n      int firstColon = a.indexOf(':');\n      int lastColon = a.lastIndexOf(':');\n      if (firstColon == -1 || lastColon == -1 || firstColon == lastColon) {\n        throw new BadAclFormatException(\n            \"ACL '\" + a + \"' not of expected form scheme:id:perm\");\n      }\n\n      ACL newAcl = new ACL();\n      newAcl.setId(new Id(a.substring(0, firstColon), a.substring(\n          firstColon + 1, lastColon)));\n      newAcl.setPerms(getPermFromString(a.substring(lastColon + 1)));\n      acl.add(newAcl);\n    }\n    \n    return acl;\n  }\n  \n  /**\n   * Parse a comma-separated list of authentication mechanisms. Each\n   * such mechanism should be of the form 'scheme:auth' -- the same\n   * syntax used for the 'addAuth' command in the ZK CLI.\n   * ","sourceCodeStart":92,"sourceCodeEnd":128,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/util/ZKUtil.java#L92-L128","documentation":"When ZKUtil splits a ZooKeeper ACL string into comma-separated entries and builds ACL objects, each entry must contain at least two colons so it can be split into scheme:id:perm (the code requires firstColon != -1, lastColon != -1, and firstColon != lastColon, which guarantees a non-empty perm segment). An entry with zero or exactly one colon — like \"world:anyone\" or \"digest:user\" — throws BadAclFormatException with this message.","triggerScenarios":"ZKUtil.stringToACLs(\"world:anyone\") (perm missing); \"sasl:hdfs\" in a hadoop.registry-style ACL config; \"world:anyone:\" (colon at the end still means firstColon == lastColon); entries produced by string concatenation that dropped the perm segment.","commonSituations":"Manually edited ZooKeeper ACL configuration where the permissions part was omitted; converting documentation examples like 'scheme:id' to config; scripts that build ACL strings from optional fields that turn out empty.","solutions":["Give every ACL entry all three parts: \"world:anyone:rwcda\" or \"sasl:zkcli:rwdca\".","Check the config key consumed by ZKUtil (e.g. the YARN registry ZooKeeper ACL property) for truncated entries.","Pre-validate with a matcher such as ^[^:]+:[^:]+:[rwcda]+$ per comma-separated entry.","Catch BadAclFormatException during config parsing and log which entry is malformed."],"exampleFix":"// before\nList<ACL> acls = ZKUtil.stringToACLs(\"world:anyone\");\n// throws: ACL 'world:anyone' not of expected form scheme:id:perm\n\n// after\nList<ACL> acls = ZKUtil.stringToACLs(\"world:anyone:rwcda\");","handlingStrategy":"validation","validationCode":"private static final Pattern ACL_ENTRY =\n    Pattern.compile(\"^[^:,]+:[^:,]+:[rwcda]+$\");\n\nstatic void validateAclEntries(String aclString) {\n  for (String entry : aclString.split(\",\")) {\n    if (!ACL_ENTRY.matcher(entry).matches()) {\n      throw new IllegalArgumentException(\n          \"ACL entry '\" + entry + \"' must be scheme:id:perm\");\n    }\n  }\n}\n\nvalidateAclEntries(aclConf); // before ZKUtil.stringToACLs","typeGuard":null,"tryCatchPattern":"try {\n  acls = ZKUtil.stringToACLs(aclString);\n} catch (ZKUtil.BadAclFormatException e) {\n  LOG.error(\"Malformed ACL entry in config; expected scheme:id:perm\", e);\n  failStartup(e);\n}","preventionTips":["Provide config examples with all three segments (scheme:id:perm) in docs.","Validate zk ACL config strings with a regex at load time.","Reject empty permission segments during config linting, not at ZK connect time."],"tags":["zookeeper","acl","configuration","validation","hadoop-common"],"backgroundTag":"zookeeper-acl-invalid","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}