{"record":{"id":"b439d1dab8dc5cd7","repo":"apache/hadoop","slug":"invalid-attribute-value-for-hadoop-security-authen","errorCode":null,"errorMessage":"Invalid attribute value for hadoop.security.authentication of ","messagePattern":"Invalid attribute value for hadoop\\.security\\.authentication of ","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SecurityUtil.java","lineNumber":796,"sourceCode":"    }\n\n    // implemented as a separate method to facilitate unit testing\n    InetAddress getInetAddressByName(String host) throws UnknownHostException {\n      return InetAddress.getByName(host);\n    }\n\n    void setSearchDomains(String ... domains) {\n      searchDomains = Arrays.asList(domains);\n    }\n  }\n\n  public static AuthenticationMethod getAuthenticationMethod(Configuration conf) {\n    String value = conf.get(HADOOP_SECURITY_AUTHENTICATION, \"simple\");\n    try {\n      return Enum.valueOf(AuthenticationMethod.class,\n          StringUtils.toUpperCase(value));\n    } catch (IllegalArgumentException iae) {\n      throw new IllegalArgumentException(\"Invalid attribute value for \" +\n          HADOOP_SECURITY_AUTHENTICATION + \" of \" + value);\n    }\n  }\n\n  public static void setAuthenticationMethod(\n      AuthenticationMethod authenticationMethod, Configuration conf) {\n    if (authenticationMethod == null) {\n      authenticationMethod = AuthenticationMethod.SIMPLE;\n    }\n    conf.set(HADOOP_SECURITY_AUTHENTICATION,\n        StringUtils.toLowerCase(authenticationMethod.toString()));\n  }\n\n  /*\n   * Check if a given port is privileged.\n   * The ports with number smaller than 1024 are treated as privileged ports in\n   * unix/linux system. For other operating systems, use this method with care.\n   * For example, Windows doesn't have the concept of privileged ports.","sourceCodeStart":778,"sourceCodeEnd":814,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SecurityUtil.java#L778-L814","documentation":"SecurityUtil.getAuthenticationMethod reads hadoop.security.authentication (default 'simple'), upper-cases it, and maps it onto the AuthenticationMethod enum. Any value that is not an enum constant throws IllegalArgumentException. Only simple and kerberos are normal user-facing settings; token/proxy are framework-internal.","triggerScenarios":"core-site.xml (or a config override chain) sets hadoop.security.authentication to a non-enum value: 'ldap', 'AD', a typo like 'kerboros', or a value with stray whitespace/newline that survives conf.get (Enum.valueOf fails on the untrimmed upper-cased string).","commonSituations":"Operators try to name an SSO/LDOPA scheme directly in the property, template engines inject trailing whitespace, or a later *-site.xml on the classpath overrides the intended value.","solutions":["Set hadoop.security.authentication to simple or kerberos","Strip whitespace and newlines from the property value in the XML","Dump the effective config (e.g. 'hadoop conf' or a Configuration.dumpConfiguration snippet) to find which file supplies the bad value","Add a pre-flight validation step that parses the value against AuthenticationMethod.valueOf before shipping configs"],"exampleFix":"<!-- before -->\n<property><name>hadoop.security.authentication</name><value>LDAP</value></property>\n\n<!-- after -->\n<property><name>hadoop.security.authentication</name><value>kerberos</value></property>","handlingStrategy":"validation","validationCode":"Set<String> ALLOWED = new HashSet<>(Arrays.asList(\"simple\", \"kerberos\"));\nString auth = conf.get(\"hadoop.security.authentication\", \"simple\").trim();\nif (!ALLOWED.contains(auth)) {\n  throw new IllegalArgumentException(\n      \"hadoop.security.authentication must be one of \" + ALLOWED + \", got: '\" + auth + \"'\");\n}","typeGuard":"static boolean isValidAuthenticationMethod(String value) {\n  try {\n    Enum.valueOf(AuthenticationMethod.class, value.trim().toUpperCase(Locale.ROOT));\n    return true;\n  } catch (IllegalArgumentException e) {\n    return false;\n  }\n}","tryCatchPattern":null,"preventionTips":["Validate the property against AuthenticationMethod.valueOf before shipping configs","Trim whitespace in XML values via config templating","Dump effective configuration in CI to catch override surprises"],"tags":["configuration","authentication","startup"],"backgroundTag":"invalid-config-value","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}