{"record":{"id":"d5eb654e98e011e2","repo":"apache/hadoop","slug":"failed-to-find-user-in-name-subject","errorCode":null,"errorMessage":"Failed to find user in name \" + subject","messagePattern":"Failed to find user in name \" \\+ subject","errorType":"exception","errorClass":"LoginException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/UserGroupInformation.java","lineNumber":234,"sourceCode":"      if (user != null) {\n        LOG.debug(\"Using user: \\\"{}\\\" with name: {}\", user, user.getName());\n\n        User userEntry = null;\n        try {\n          // LoginContext will be attached later unless it's an external\n          // subject.\n          AuthenticationMethod authMethod = (user instanceof KerberosPrincipal)\n            ? AuthenticationMethod.KERBEROS : AuthenticationMethod.SIMPLE;\n          userEntry = new User(user.getName(), authMethod, null);\n        } catch (Exception e) {\n          throw (LoginException)(new LoginException(e.toString()).initCause(e));\n        }\n        LOG.debug(\"User entry: \\\"{}\\\"\", userEntry);\n\n        subject.getPrincipals().add(userEntry);\n        return true;\n      }\n      throw new LoginException(\"Failed to find user in name \" + subject);\n    }\n\n    @Override\n    public void initialize(Subject subject, CallbackHandler callbackHandler,\n                           Map<String, ?> sharedState, Map<String, ?> options) {\n      this.subject = subject;\n    }\n\n    @Override\n    public boolean login() throws LoginException {\n      LOG.debug(\"Hadoop login\");\n      return true;\n    }\n\n    @Override\n    public boolean logout() throws LoginException {\n      LOG.debug(\"Hadoop logout\");\n      return true;","sourceCodeStart":216,"sourceCodeEnd":252,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/UserGroupInformation.java#L216-L252","documentation":"HadoopLoginModule.commit() attaches a User principal to the JAAS subject by walking subject.getPrincipals() and wrapping the first one (Kerberos or simple). If the subject contains no principals at all when commit runs, it throws this LoginException (the message stringifies the subject), aborting the login.","triggerScenarios":"Any login path that installs HadoopLoginModule (loginUserFromKeytab, loginUserFromTicketCache, doSubjectLogin/getUGIFromSubject) reaching commit() with an empty subject - a Kerberos module failed before adding its principal, a custom JAAS configuration replaced Hadoop's, or an externally built Subject was handed over with no Principal.","commonSituations":"No TGT (missing kinit) so Krb5LoginModule added no principal; krb5.conf misconfigured or KDC unreachable; a hand-written JAAS config file overriding the hadoop-client entries; code constructing bare Subjects for SPNEGO.","solutions":["Run `klist`; if empty, `kinit` before starting the client/job","Prefer UserGroupInformation.loginUserFromKeytab(principal, keytab) or loginUserFromTicketCache over hand-built JAAS subjects","Verify no custom javax.security.auth.login.Configuration is stripping Hadoop's login modules","For externally authenticated subjects, add at least one Principal (a KerberosPrincipal) before calling getUGIFromSubject"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"if (subject.getPrincipals().isEmpty()) {\n  throw new IllegalStateException(\n      \"cannot login: subject has no principals\");\n}","typeGuard":null,"tryCatchPattern":"try {\n  UserGroupInformation.loginUserFromKeytab(principal, keytab);\n} catch (LoginException | KerberosAuthException e) {\n  // LoginException text 'Failed to find user' means commit() saw an empty subject\n  LOG.error(\"Hadoop login failed for {}\", principal, e);\n  throw e;\n}","preventionTips":["Run `klist` in service entrypoints and fail fast when no TGT exists","Do not override Hadoop's JAAS entries with custom login config files","For external subjects, add a Principal before calling getUGIFromSubject"],"tags":["hadoop","jaas","login","kerberos","ugi"],"backgroundTag":"jaas-login-failed","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}