{"record":{"id":"e8273e2cce0be155","repo":"apache/hadoop","slug":"client-mechanism-is-malformed","errorCode":null,"errorMessage":"Client mechanism is malformed","messagePattern":"Client mechanism is malformed","errorType":"exception","errorClass":"SaslException","httpStatus":null,"severity":"critical","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/ipc/Server.java","lineNumber":2416,"sourceCode":"      final SaslState state = saslMessage.getState(); // required      \n      switch (state) {\n        case NEGOTIATE: {\n          if (sentNegotiate) {\n            // FIXME shouldn't this be SaslException?\n            throw new AccessControlException(\n                \"Client already attempted negotiation\");\n          }\n          saslResponse = buildSaslNegotiateResponse();\n          // simple-only server negotiate response is success which client\n          // interprets as switch to simple\n          if (saslResponse.getState() == SaslState.SUCCESS) {\n            switchToSimple();\n          }\n          break;\n        }\n        case INITIATE: {\n          if (saslMessage.getAuthsCount() != 1) {\n            throw new SaslException(\"Client mechanism is malformed\");\n          }\n          // verify the client requested an advertised authType\n          SaslAuth clientSaslAuth = saslMessage.getAuths(0);\n          if (!negotiateResponse.getAuthsList().contains(clientSaslAuth)) {\n            if (sentNegotiate) {\n              throw new AccessControlException(\n                  clientSaslAuth.getMethod() + \" authentication is not enabled.\"\n                      + \"  Available:\" + enabledAuthMethods);\n            }\n            saslResponse = buildSaslNegotiateResponse();\n            break;\n          }\n          authMethod = AuthMethod.valueOf(clientSaslAuth.getMethod());\n          // abort SASL for SIMPLE auth, server has already ensured that\n          // SIMPLE is a legit option above.  we will send no response\n          if (authMethod == AuthMethod.SIMPLE) {\n            switchToSimple();\n            saslResponse = null;","sourceCodeStart":2398,"sourceCodeEnd":2434,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/ipc/Server.java#L2398-L2434","documentation":"In processSaslMessage's INITIATE case, the client's SASL INITIATE message must carry exactly one auth mechanism entry (getAuthsCount() == 1); zero or multiple entries throw SaslException(\"Client mechanism is malformed\"). After that count check, the single mechanism is validated against the methods the server advertised.","triggerScenarios":"A client building RpcSaslProto INITIATE with no SaslAuth or with several: hand-written or native clients constructing the protobuf manually, schema/version skew producing wrong field counts, or corrupted frames on the wire.","commonSituations":"Non-Java or custom clients implementing the Hadoop SASL protocol directly; mismatched Hadoop protobuf definitions between client and server; protocol bridges that mangle the INITIATE message.","solutions":["Send exactly one SaslAuth in INITIATE, copied from one entry of the server's negotiate response.","Use the standard client libraries to build and serialize the SASL handshake.","Align client and server Hadoop versions so the RpcSaslProto definitions match."],"exampleFix":"// before — malformed INITIATE (zero or multiple auths)\nRpcSaslProto.Builder b = RpcSaslProto.newBuilder()\n    .setState(SaslState.INITIATE); // no addAuths, or addAuths called twice\n// after — exactly one mechanism\nRpcSaslProto.Builder b = RpcSaslProto.newBuilder()\n    .setState(SaslState.INITIATE)\n    .addAuths(RpcSaslProto.SaslAuth.newBuilder()\n        .setMethod(authMethod)\n        .setMechanism(mechanism));","handlingStrategy":"validation","validationCode":"RpcSaslProto initiate = buildInitiate(selectedAuth);\nif (initiate.getAuthsCount() != 1) {\n  throw new IllegalStateException(\n      \"INITIATE must carry exactly one auth mechanism, got \"\n          + initiate.getAuthsCount());\n}\nsend(initiate);","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Copy the single chosen SaslAuth from the server's negotiate response instead of building entries by hand.","Use the standard client libraries to serialize the SASL handshake.","Keep client and server Hadoop/protobuf versions aligned."],"tags":["rpc","sasl","security","protocol","malformed-message"],"backgroundTag":"sasl-negotiation-failed","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}