{"id":"8ad4212b945d49a8","repo":"apache/kafka","slug":"operation-must-not-be-any","errorCode":null,"errorMessage":"operation must not be ANY","messagePattern":"operation must not be ANY","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"clients/src/main/java/org/apache/kafka/common/acl/AccessControlEntry.java","lineNumber":44,"sourceCode":" */\n@InterfaceAudience.Public\npublic class AccessControlEntry {\n    final AccessControlEntryData data;\n\n    /**\n     * Create an instance of an access control entry with the provided parameters.\n     *\n     * @param principal non-null principal\n     * @param host non-null host\n     * @param operation non-null operation, ANY is not an allowed operation\n     * @param permissionType non-null permission type, ANY is not an allowed type\n     */\n    public AccessControlEntry(String principal, String host, AclOperation operation, AclPermissionType permissionType) {\n        Objects.requireNonNull(principal);\n        Objects.requireNonNull(host);\n        Objects.requireNonNull(operation);\n        if (operation == AclOperation.ANY)\n            throw new IllegalArgumentException(\"operation must not be ANY\");\n        Objects.requireNonNull(permissionType);\n        if (permissionType == AclPermissionType.ANY)\n            throw new IllegalArgumentException(\"permissionType must not be ANY\");\n        this.data = new AccessControlEntryData(principal, host, operation, permissionType);\n    }\n\n    /**\n     * Return the principal for this entry.\n     */\n    public String principal() {\n        return data.principal();\n    }\n\n    /**\n     * Return the host or `*` for all hosts.\n     */\n    public String host() {\n        return data.host();","sourceCodeStart":26,"sourceCodeEnd":62,"githubUrl":"https://github.com/apache/kafka/blob/c31c9215e131f8c17e79f8901b48c13ee6aa8e7a/clients/src/main/java/org/apache/kafka/common/acl/AccessControlEntry.java#L26-L62","documentation":"Thrown by the AccessControlEntry constructor when the supplied AclOperation is AclOperation.ANY. ANY is a wildcard valid only in filters (AccessControlEntryFilter) for matching, not in a concrete ACL entry that the broker must store; an actual grant must specify a real operation (READ, WRITE, CREATE, etc.). The IllegalArgumentException guards against persisting an underspecified permission.","triggerScenarios":"Constructing `new AccessControlEntry(principal, host, AclOperation.ANY, permissionType)` directly. Also reached when reusing a filter object's operation() value, or deserializing/building an ACE from user input that defaulted the operation to ANY because none was chosen.","commonSituations":"UI/CLI exposing an ACL form where the operation dropdown defaults to ANY; copying values from a filter into a createAcls request; helper code that shares a builder between filters and entries; tests that pass ANY as a placeholder.","solutions":["Choose a concrete operation: READ, WRITE, CREATE, DELETE, ALTER, DESCRIBE, CLUSTER_ACTION, ALTER_CONFIGS, DESCRIBE_CONFIGS, IDEMPOTENT_WRITE, or ALL.","If matching ACLs is the intent, build an AccessControlEntryFilter (which permits ANY) instead of an AccessControlEntry.","Validate user input upstream and reject 'ANY' before constructing the ACE, surfacing a domain-specific error."],"exampleFix":"// before\nnew AccessControlEntry(principal, host, AclOperation.ANY, AclPermissionType.ALLOW);\n\n// after\nnew AccessControlEntry(principal, host, AclOperation.READ, AclPermissionType.ALLOW);\n// or, for matching:\nnew AccessControlEntryFilter(principal, host, AclOperation.ANY, AclPermissionType.ANY);","handlingStrategy":"validation","validationCode":"// AclOperation.ANY is a wildcard meaningful only for filters, never for a concrete ACE\nAclOperation op = /* from config/request */;\nif (op == null) { /* reject: null principal operation */ }\nif (op == AclOperation.ANY) {\n    // pick a concrete operation (READ/WRITE/CREATE/...) or reject the request\n}","typeGuard":"// Narrow an AclOperation to the subset legal inside an AccessControlEntry\nstatic boolean isConcreteAclOperation(AclOperation op) {\n    return op != null && op != AclOperation.ANY;\n}","tryCatchPattern":"try {\n    AccessControlEntry ace = new AccessControlEntry(principal, host, op, perm);\n} catch (IllegalArgumentException e) {\n    // message is literally \"operation must not be ANY\"; re-prompt caller/config for a concrete op\n}","preventionTips":["Reserve AclOperation.ANY for AccessControlEntryFilter (query side); never persist it in an ACE.","Validate ACL config at load time, not at ACE construction time, so bad rows fail fast and visibly.","If exposing ACL creation via UI/API, omit ANY from the operation picker for create/update endpoints.","Unit-test your ACL factory with the ANY input to prove it rejects before reaching the constructor."],"tags":["acl","authorization","argument","java"],"analyzedSha":"c31c9215e131f8c17e79f8901b48c13ee6aa8e7a","analyzedAt":"2026-08-03T12:34:05.770Z","schemaVersion":2}