{"record":{"id":"adfdb1f3533205da","repo":"apache/hadoop","slug":"cannot-determine-ugi-from-request-or-conf","errorCode":null,"errorMessage":"Cannot determine UGI from request or conf","messagePattern":"Cannot determine UGI from request or conf","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/common/JspHelper.java","lineNumber":64,"sourceCode":"\nimport static org.apache.hadoop.fs.CommonConfigurationKeys.DEFAULT_HADOOP_HTTP_STATIC_USER;\nimport static org.apache.hadoop.fs.CommonConfigurationKeys.HADOOP_HTTP_STATIC_USER;\n\n@InterfaceAudience.Private\npublic class JspHelper {\n  public static final String CURRENT_CONF = \"current.conf\";\n  public static final String DELEGATION_PARAMETER_NAME = DelegationParam.NAME;\n  public static final String NAMENODE_ADDRESS = \"nnaddr\";\n  private static final Logger LOG = LoggerFactory.getLogger(JspHelper.class);\n\n  /** Private constructor for preventing creating JspHelper object. */\n  private JspHelper() {}\n\n  public static String getDefaultWebUserName(Configuration conf) throws IOException {\n    String user = conf.get(\n        HADOOP_HTTP_STATIC_USER, DEFAULT_HADOOP_HTTP_STATIC_USER);\n    if (user == null || user.length() == 0) {\n      throw new IOException(\"Cannot determine UGI from request or conf\");\n    }\n    return user;\n  }\n\n  private static InetSocketAddress getNNServiceAddress(ServletContext context,\n      HttpServletRequest request) {\n    String namenodeAddressInUrl = request.getParameter(NAMENODE_ADDRESS);\n    InetSocketAddress namenodeAddress = null;\n    if (namenodeAddressInUrl != null) {\n      namenodeAddress = NetUtils.createSocketAddr(namenodeAddressInUrl);\n    } else if (context != null) {\n      namenodeAddress = NameNodeHttpServer.getNameNodeAddressFromContext(\n          context); \n    }\n    if (namenodeAddress != null) {\n      return namenodeAddress;\n    }\n    return null;","sourceCodeStart":46,"sourceCodeEnd":82,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/common/JspHelper.java#L46-L82","documentation":"JspHelper.getDefaultWebUserName supplies the fallback web identity when security is off and the request carries no user parameter: it reads CommonConfigurationKeys.HADOOP_HTTP_STATIC_USER (hadoop.http.staticuser.user) with default 'dr.who'. If the configured value is null or empty, it throws IOException('Cannot determine UGI from request or conf') because no identity can be derived at all. Note the default is non-empty, so hitting this requires explicitly blanking the config.","triggerScenarios":"A non-secured (simple auth) HTTP request to a NameNode/DataNode JSP or servlet that calls JspHelper.getUGI without a user.name/ugi query parameter, while hadoop.http.staticuser.user is set to an empty string or null in the effective configuration.","commonSituations":"Operators set the static user to '' believing it disables the fallback (it does not — it breaks JSP access); environment-specific config overlays blank the key; raw curl hits browseDirectory.jsp or a webhdfs URL with no user.name parameter after the config change.","solutions":["Set hadoop.http.staticuser.user to a valid, preferably unprivileged account (or remove the override to fall back to 'dr.who')","Alternatively pass the user explicitly: append '?user.name=<who>' to the request URL","Or enable Kerberos security so the authentication filter derives the user instead of the static fallback"],"exampleFix":"<!-- before -->\n<property><name>hadoop.http.staticuser.user</name><value></value></property>\n\n<!-- after -->\n<property><name>hadoop.http.staticuser.user</name><value>dr.who</value></property>","handlingStrategy":"validation","validationCode":"String staticUser = conf.get(\n    CommonConfigurationKeys.HADOOP_HTTP_STATIC_USER,\n    CommonConfigurationKeys.DEFAULT_HADOOP_HTTP_STATIC_USER);\nif (staticUser == null || staticUser.isEmpty()) {\n  throw new IOException(\"hadoop.http.staticuser.user must be a non-empty username\");\n}\n// safe to call JspHelper.getUGI for anonymous simple-auth requests","typeGuard":null,"tryCatchPattern":"try {\n  ugi = JspHelper.getUGI(context, request, conf);\n} catch (IOException e) {\n  if (\"Cannot determine UGI from request or conf\".equals(e.getMessage())) {\n    resp.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR,\n        \"static web user misconfigured (hadoop.http.staticuser.user)\");\n  } else throw e;\n}","preventionTips":["Never blank hadoop.http.staticuser.user to 'disable' it — remove the property instead","Config-test web UI reachability after changing static-user settings","Prefer enabling real authentication over relying on the static fallback user"],"tags":["hdfs","web-ui","jsp","ugi","static-user","config"],"backgroundTag":"missing-config-value","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}