{"record":{"id":"b1e5405ab54ac99b","repo":"apache/hadoop","slug":"does-not-support-partial-group-name-resolution-on","errorCode":null,"errorMessage":"Does not support partial group name resolution on Windows. \" + errMessage","messagePattern":"Does not support partial group name resolution on Windows\\. \" \\+ errMessage","errorType":"exception","errorClass":"PartialGroupNameException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/ShellBasedUnixGroupsMapping.java","lineNumber":287,"sourceCode":"  }\n\n  /**\n   * Attempt to partially resolve group names.\n   *\n   * @param userName the user's name\n   * @param errMessage error message from the shell command\n   * @param groupNames the incomplete list of group names\n   * @return a set of resolved group names\n   * @throws PartialGroupNameException if the resolution fails or times out\n   */\n  private Set<String> resolvePartialGroupNames(String userName,\n      String errMessage, String groupNames) throws PartialGroupNameException {\n    // Exception may indicate that some group names are not resolvable.\n    // Shell-based implementation should tolerate unresolvable groups names,\n    // and return resolvable ones, similar to what JNI-based implementation\n    // does.\n    if (Shell.WINDOWS) {\n      throw new PartialGroupNameException(\"Does not support partial group\"\n      + \" name resolution on Windows. \" + errMessage);\n    }\n    if (groupNames.isEmpty()) {\n      throw new PartialGroupNameException(\"The user name '\" + userName\n          + \"' is not found. \" + errMessage);\n    } else {\n      LOG.warn(\"Some group names for '{}' are not resolvable. {}\",\n          userName, errMessage);\n      // attempt to partially resolve group names\n      ShellCommandExecutor partialResolver = createGroupIDExecutor(userName);\n      try {\n        partialResolver.execute();\n        return parsePartialGroupNames(\n            groupNames, partialResolver.getOutput());\n      } catch (ExitCodeException ece) {\n        // If exception is thrown trying to get group id list,\n        // something is terribly wrong, so give up.\n        throw new PartialGroupNameException(","sourceCodeStart":269,"sourceCodeEnd":305,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/ShellBasedUnixGroupsMapping.java#L269-L305","documentation":"ShellBasedUnixGroupsMapping.resolvePartialGroupNames supports recovering a partial group list when the initial lookup fails. On Windows (Shell.WINDOWS) the Unix-style partial-resolution fallback (a group-id shell helper) does not exist, so the partial failure is rethrown as PartialGroupNameException with the original shell error appended.","triggerScenarios":"A Windows host performs group mapping for a user whose lookup partially failed (at least one unresolvable group), so the Linux-only partial resolution path cannot run and the mapping fails outright.","commonSituations":"Windows nodes in mixed clusters; AD groups deleted while still set as a user's primary group; the Hadoop service account lacking permission to read all group SIDs.","solutions":["Identify the unresolvable group from the embedded error text and fix the user's membership in AD","Run the same lookup as the Hadoop service account on Windows to confirm it can enumerate all groups","Configure LdapGroupsMapping against AD so group resolution does not depend on shell behavior","As a workaround, remove the user from the stale/unresolvable group"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  groups = mapping.getGroups(user);\n} catch (PartialGroupNameException e) {\n  if (org.apache.hadoop.util.Shell.WINDOWS\n      && e.getMessage().contains(\"Windows\")) {\n    // no partial resolution possible: fail over to another mapping backend or LdapGroupsMapping\n  }\n  throw e;\n}","preventionTips":["Keep Windows-node users' group memberships fully resolvable in AD","Prefer LdapGroupsMapping for Windows-heavy clusters","Test service-account group enumeration on Windows before going live"],"tags":["windows","group-mapping","active-directory","partial-resolution"],"backgroundTag":"group-resolution-failed","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}