{"record":{"id":"ec73f5af67451fa7","repo":"apache/hadoop","slug":"subject-must-not-be-null","errorCode":null,"errorMessage":"Subject must not be null","messagePattern":"Subject must not be null","errorType":"exception","errorClass":"KerberosAuthException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/UserGroupInformation.java","lineNumber":653,"sourceCode":"    params.put(LoginParam.CCACHE, ticketCache);\n    return doSubjectLogin(null, params);\n  }\n\n  /**\n   * Create a UserGroupInformation from a Subject with Kerberos principal.\n   *\n   * @param subject             The KerberosPrincipal to use in UGI.\n   *                            The creator of subject is responsible for\n   *                            renewing credentials.\n   *\n   * @throws IOException raised on errors performing I/O.\n   * @throws KerberosAuthException if the kerberos login fails\n   * @return UserGroupInformation\n   */\n  public static UserGroupInformation getUGIFromSubject(Subject subject)\n      throws IOException {\n    if (subject == null) {\n      throw new KerberosAuthException(SUBJECT_MUST_NOT_BE_NULL);\n    }\n\n    if (subject.getPrincipals(KerberosPrincipal.class).isEmpty()) {\n      throw new KerberosAuthException(SUBJECT_MUST_CONTAIN_PRINCIPAL);\n    }\n\n    // null params indicate external subject login.  no login context will\n    // be attached.\n    return doSubjectLogin(subject, null);\n  }\n\n  /**\n   * Get the currently logged in user.  If no explicit login has occurred,\n   * the user will automatically be logged in with either kerberos credentials\n   * if available, or as the local OS user, based on security settings.\n   * @return the logged in user\n   * @throws IOException if login fails\n   */","sourceCodeStart":635,"sourceCodeEnd":671,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/UserGroupInformation.java#L635-L671","documentation":"UserGroupInformation.getUGIFromSubject rejects a null Subject immediately with KerberosAuthException(SUBJECT_MUST_NOT_BE_NULL) (an IOException subclass). The API exists to wrap an externally performed Kerberos login, so a null argument is a caller bug.","triggerScenarios":"getUGIFromSubject(null) - typically a variable never initialized, or an upstream login step returned null (e.g., Subject.getSubject(accessControlContext) outside a doAs scope).","commonSituations":"Optional LoginContext results not checked; calling Subject.getSubject(...) from a thread not running inside Subject.doAs; race where the subject field is read before assignment.","solutions":["Null-check the Subject before calling getUGIFromSubject","If the Subject came from Subject.getSubject(acc), run the code inside Subject.doAs so a subject is associated","When no explicit subject exists, fall back to UserGroupInformation.getLoginUser()"],"exampleFix":"// before\nUserGroupInformation ugi = UserGroupInformation.getUGIFromSubject(subject);\n// after\nUserGroupInformation ugi = (subject != null)\n    ? UserGroupInformation.getUGIFromSubject(subject)\n    : UserGroupInformation.getLoginUser();","handlingStrategy":"validation","validationCode":"if (subject == null) {\n  throw new IllegalArgumentException(\"subject required for getUGIFromSubject\");\n}","typeGuard":"Objects.requireNonNull(subject, \"kerberos subject must not be null\");","tryCatchPattern":null,"preventionTips":["Null-check subjects from Optional/login sources before use","Wrap Subject.getSubject(acc) callers in Subject.doAs scope","Default to getLoginUser() when no explicit subject exists"],"tags":["hadoop","kerberos","ugi","null-check"],"backgroundTag":"null-argument","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}