{"id":"6b92bed09ffee7a2","repo":"apache/kafka","slug":"permissiontype-must-not-be-any","errorCode":null,"errorMessage":"permissionType must not be ANY","messagePattern":"permissionType must not be ANY","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"clients/src/main/java/org/apache/kafka/common/acl/AccessControlEntry.java","lineNumber":47,"sourceCode":"    final AccessControlEntryData data;\n\n    /**\n     * Create an instance of an access control entry with the provided parameters.\n     *\n     * @param principal non-null principal\n     * @param host non-null host\n     * @param operation non-null operation, ANY is not an allowed operation\n     * @param permissionType non-null permission type, ANY is not an allowed type\n     */\n    public AccessControlEntry(String principal, String host, AclOperation operation, AclPermissionType permissionType) {\n        Objects.requireNonNull(principal);\n        Objects.requireNonNull(host);\n        Objects.requireNonNull(operation);\n        if (operation == AclOperation.ANY)\n            throw new IllegalArgumentException(\"operation must not be ANY\");\n        Objects.requireNonNull(permissionType);\n        if (permissionType == AclPermissionType.ANY)\n            throw new IllegalArgumentException(\"permissionType must not be ANY\");\n        this.data = new AccessControlEntryData(principal, host, operation, permissionType);\n    }\n\n    /**\n     * Return the principal for this entry.\n     */\n    public String principal() {\n        return data.principal();\n    }\n\n    /**\n     * Return the host or `*` for all hosts.\n     */\n    public String host() {\n        return data.host();\n    }\n\n    /**","sourceCodeStart":29,"sourceCodeEnd":65,"githubUrl":"https://github.com/apache/kafka/blob/c31c9215e131f8c17e79f8901b48c13ee6aa8e7a/clients/src/main/java/org/apache/kafka/common/acl/AccessControlEntry.java#L29-L65","documentation":"Thrown by the AccessControlEntry constructor when the supplied AclPermissionType is AclPermissionType.ANY. Like AclOperation.ANY, the ANY permission type is a wildcard permitted only in filters; a stored access control entry must be explicitly ALLOW or DENY. The IllegalArgumentException prevents persisting an ambiguous grant/deny.","triggerScenarios":"Constructing `new AccessControlEntry(principal, host, operation, AclPermissionType.ANY)`. Commonly happens when permissionType is left as the enum default, taken from a filter object, or supplied from a form/API caller that did not pick allow vs deny.","commonSituations":"Defaults in CLI/admin tooling that choose ANY when unspecified; sharing model objects between filter and entry construction; migrating from legacy ACL representations that lacked an allow/deny flag.","solutions":["Set an explicit permission type: AclPermissionType.ALLOW or AclPermissionType.DENY.","If your goal is to search/match existing ACLs, use AccessControlEntryFilter, which accepts ANY.","Fail fast in your own input layer: require allow/deny before reaching the constructor."],"exampleFix":"// before\nnew AccessControlEntry(principal, host, AclOperation.READ, AclPermissionType.ANY);\n\n// after\nnew AccessControlEntry(principal, host, AclOperation.READ, AclPermissionType.ALLOW);","handlingStrategy":"validation","validationCode":"// AclPermissionType.ANY is a wildcard meaningful only for filters, never for a concrete ACE\nAclPermissionType perm = /* from config/request */;\nif (perm == null) { /* reject */ }\nif (perm == AclPermissionType.ANY) {\n    // choose ALLOW or DENY explicitly, or reject the request\n}","typeGuard":"// Narrow an AclPermissionType to the subset legal inside an AccessControlEntry\nstatic boolean isConcreteAclPermissionType(AclPermissionType p) {\n    return p != null && p != AclPermissionType.ANY;\n}","tryCatchPattern":"try {\n    AccessControlEntry ace = new AccessControlEntry(principal, host, op, perm);\n} catch (IllegalArgumentException e) {\n    // message is literally \"permissionType must not be ANY\"; require caller to supply ALLOW/DENY\n}","preventionTips":["Reserve AclPermissionType.ANY for AccessControlEntryFilter; never store it on an ACE.","Make ALLOW/DENY an explicit, required field in any ACL creation form or request schema.","Validate permissionType together with operation in one ACL-builder helper so both ANY cases are caught together.","Add a JSON schema / Protobuf validator that forbids \"ANY\" for persisted permission types."],"tags":["acl","authorization","argument","java"],"analyzedSha":"c31c9215e131f8c17e79f8901b48c13ee6aa8e7a","analyzedAt":"2026-08-03T12:34:05.770Z","schemaVersion":2}