{"record":{"id":"d909f34af73c724c","repo":"grpc/grpc-java","slug":"unknown-principal-identifier-case-principal-g","errorCode":null,"errorMessage":"Unknown principal identifier case: \" + principal.getIdentifierCase()","messagePattern":"Unknown principal identifier case: \" \\+ principal\\.getIdentifierCase\\(\\)","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"xds/src/main/java/io/grpc/xds/RbacFilter.java","lineNumber":300,"sourceCode":"        return createSourceIpMatcher(principal.getRemoteIp());\n      case SOURCE_IP: {\n        // gRFC A41 has identical handling of source_ip as remote_ip and direct_remote_ip and\n        // pre-dates the deprecation.\n        @SuppressWarnings(\"deprecation\")\n        CidrRange sourceIp = principal.getSourceIp();\n        return createSourceIpMatcher(sourceIp);\n      }\n      case HEADER:\n        return parseHeaderMatcher(principal.getHeader());\n      case NOT_ID:\n        return InvertMatcher.create(parsePrincipal(principal.getNotId()));\n      case URL_PATH:\n        return parsePathMatcher(principal.getUrlPath());\n      case METADATA: // hard coded, never match.\n        return InvertMatcher.create(AlwaysTrueMatcher.INSTANCE);\n      case IDENTIFIER_NOT_SET:\n      default:\n        throw new IllegalArgumentException(\n                \"Unknown principal identifier case: \" + principal.getIdentifierCase());\n    }\n  }\n\n  private static PathMatcher parsePathMatcher(\n          io.envoyproxy.envoy.type.matcher.v3.PathMatcher proto) {\n    switch (proto.getRuleCase()) {\n      case PATH:\n        return PathMatcher.create(MatcherParser.parseStringMatcher(proto.getPath()));\n      case RULE_NOT_SET:\n      default:\n        throw new IllegalArgumentException(\n                \"Unknown path matcher rule type: \" + proto.getRuleCase());\n    }\n  }\n\n  private static RequestedServerNameMatcher parseRequestedServerNameMatcher(\n          io.envoyproxy.envoy.type.matcher.v3.StringMatcher proto) {","sourceCodeStart":282,"sourceCodeEnd":318,"githubUrl":"https://github.com/grpc/grpc-java/blob/64daddc1f3d1975670f769f3e97bde8b2ba32d25/xds/src/main/java/io/grpc/xds/RbacFilter.java#L282-L318","documentation":"RBAC principal protos use a oneof 'identifier' (and_ids, or_ids, not_id, authenticated, source_ip, header, url_path, metadata, etc.). parsePrincipal throws IllegalArgumentException when the identifier is unset or is a case this client version doesn't implement, since no matcher can be constructed for the principal.","triggerScenarios":"An RBAC policy's principals list contains a Principal with IDENTIFIER_NOT_SET or a newly added Envoy identifier case unknown to the loaded protos; parsePrincipal recurses through parsePrincipalList and hits the default branch.","commonSituations":"Envoy control plane newer than gRPC client protos using a new principal identifier; empty principal block in a policy; custom xDS server emitting incomplete RBAC policies.","solutions":["Upgrade grpc-xds dependency to match the control plane's Envoy API version","Ensure each Principal in the RBAC policy has an identifier set on the control plane","Rewrite unsupported identifier cases using supported ones (authenticated, source_ip, header, url_path, and/or/not)","Log/print the offending identifier case from the message to pinpoint the policy entry"],"exampleFix":"# before\nprincipals: {}\n# after\nprincipals:\n  - authenticated: {principal_name: {exact: \"spiffe://cluster/ns/sa/sa-name\"}}","handlingStrategy":"validation","validationCode":"if (principal.getIdentifierCase() == Principal.IdentifierCase.IDENTIFIER_NOT_SET) {\n  throw new IllegalArgumentException(\"RBAC principal must have an identifier\");\n}","typeGuard":null,"tryCatchPattern":"try {\n  Matcher m = parsePrincipal(principal);\n} catch (IllegalArgumentException e) {\n  logger.warning(\"Unsupported RBAC principal: \" + e.getMessage());\n  // reject the policy; do not default to allow-all\n}","preventionTips":["Always set exactly one identifier on each Principal","Pin grpc-xds protos to >= control plane Envoy API version","Validate RBAC policies with Envoy before pushing to gRPC clients"],"tags":["grpc","xds","rbac","authorization","protobuf"],"backgroundTag":"unsupported-enum-value","analyzedSha":"64daddc1f3d1975670f769f3e97bde8b2ba32d25","analyzedAt":"2026-09-08T06:14:57.704Z","contentChangedAt":"2026-09-08T06:14:57.704Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}