{"record":{"id":"b768601674b92106","repo":"apache/hadoop","slug":"the-user-name-username-is-not-found","errorCode":null,"errorMessage":"The user name '\" + userName + \"' is not found. \" + errMessage","messagePattern":"The user name '\" \\+ userName \\+ \"' is not found\\. \" \\+ errMessage","errorType":"exception","errorClass":"PartialGroupNameException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/ShellBasedUnixGroupsMapping.java","lineNumber":291,"sourceCode":"   *\n   * @param userName the user's name\n   * @param errMessage error message from the shell command\n   * @param groupNames the incomplete list of group names\n   * @return a set of resolved group names\n   * @throws PartialGroupNameException if the resolution fails or times out\n   */\n  private Set<String> resolvePartialGroupNames(String userName,\n      String errMessage, String groupNames) throws PartialGroupNameException {\n    // Exception may indicate that some group names are not resolvable.\n    // Shell-based implementation should tolerate unresolvable groups names,\n    // and return resolvable ones, similar to what JNI-based implementation\n    // does.\n    if (Shell.WINDOWS) {\n      throw new PartialGroupNameException(\"Does not support partial group\"\n      + \" name resolution on Windows. \" + errMessage);\n    }\n    if (groupNames.isEmpty()) {\n      throw new PartialGroupNameException(\"The user name '\" + userName\n          + \"' is not found. \" + errMessage);\n    } else {\n      LOG.warn(\"Some group names for '{}' are not resolvable. {}\",\n          userName, errMessage);\n      // attempt to partially resolve group names\n      ShellCommandExecutor partialResolver = createGroupIDExecutor(userName);\n      try {\n        partialResolver.execute();\n        return parsePartialGroupNames(\n            groupNames, partialResolver.getOutput());\n      } catch (ExitCodeException ece) {\n        // If exception is thrown trying to get group id list,\n        // something is terribly wrong, so give up.\n        throw new PartialGroupNameException(\n            \"failed to get group id list for user '\" + userName + \"'\", ece);\n      } catch (IOException ioe) {\n        String message =\n            \"Can't execute the shell command to \" +","sourceCodeStart":273,"sourceCodeEnd":309,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/ShellBasedUnixGroupsMapping.java#L273-L309","documentation":"ShellBasedUnixGroupsMapping.resolvePartialGroupNames is entered after the primary group lookup already failed. If the partially captured output contains no group names at all, the user itself is unknown, so PartialGroupNameException reports 'The user name X is not found' plus the original shell error text.","triggerScenarios":"Group mapping is requested for a user that does not exist on the host (no passwd/AD object), so the shell lookup prints an error and an empty name list; typical when client-supplied usernames reach ShellBasedUnixGroupsMapping unvalidated.","commonSituations":"Proxy users or NFS/WebHDFS gateways forwarding usernames absent from the mapping host; typos; users from an untrusted domain without proper trust or search filters.","solutions":["Confirm the user exists on the mapping node: 'id <user>' / 'getent passwd <user>'","Fix LDAP search filters or domain trust so the user resolves","Add static mapping overrides (hadoop.user.group.static.mapping.overrides) for synthetic users","Validate usernames at the entry point (proxy ACLs, gateway auth) before they reach group mapping"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"static boolean userExists(String user) throws IOException {\n  Process p = new ProcessBuilder(\"id\", user).start();\n  try { return p.waitFor() == 0; }\n  finally { p.destroy(); }\n}\n// gate proxy/gateway usernames through this before group mapping","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Reject unknown usernames at the authentication/proxy boundary","Keep hadoop.user.group.static.mapping.overrides for service users","Alert when mapping requests reference users absent from the directory"],"tags":["unix","group-mapping","user-not-found"],"backgroundTag":"user-resolution-failed","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}