grpc/grpc-java · error · IllegalArgumentException

"name" is absent or empty

Error message

"name" is absent or empty

What it means

A valid gRPC authorization policy must carry a non-empty top-level "name" field identifying the policy. After confirming the input is a JSON object, translate() reads JsonUtil.getString(json, "name") and throws IllegalArgumentException when it is missing, null, or an empty string.

Source

Thrown at authz/src/main/java/io/grpc/authz/AuthorizationPolicyTranslator.java:177

   * Translates a gRPC authorization policy in JSON string to Envoy RBAC policies.
   * On success, will return one of the following -
   * 1. One allow RBAC policy or,
   * 2. Two RBAC policies, deny policy followed by allow policy.
   * If the policy cannot be parsed or is invalid, an exception will be thrown.
   */
  public static List<RBAC> translate(String authorizationPolicy) 
            throws IllegalArgumentException, IOException {
    Object jsonObject = JsonParser.parse(authorizationPolicy);
    if (!(jsonObject instanceof Map)) {
      throw new IllegalArgumentException(
          "Authorization policy should be a JSON object. Found: "
          + (jsonObject == null ? null : jsonObject.getClass()));
    }
    @SuppressWarnings("unchecked")
    Map<String, ?> json = (Map<String, ?>)jsonObject;
    String name = JsonUtil.getString(json, "name");
    if (name == null || name.isEmpty()) {
      throw new IllegalArgumentException("\"name\" is absent or empty");
    }
    List<RBAC> rbacs = new ArrayList<>();
    List<Map<String, ?>> objects = JsonUtil.getListOfObjects(json, "deny_rules");
    if (objects != null && !objects.isEmpty()) {
      rbacs.add(
          RBAC.newBuilder()
          .setAction(Action.DENY)
          .putAllPolicies(parseRules(objects, name))
          .build());
    }
    objects = JsonUtil.getListOfObjects(json, "allow_rules");
    if (objects == null || objects.isEmpty()) {
      throw new IllegalArgumentException("\"allow_rules\" is absent");
    }
    rbacs.add(
        RBAC.newBuilder()
        .setAction(Action.ALLOW)
        .putAllPolicies(parseRules(objects, name))

View on GitHub (pinned to 64daddc1f3)

Solutions

1. Add a non-empty "name" string field at the top level of the authorization policy JSON
2. Validate required fields (name, rules) before calling translate()
3. If generating the policy in code, always set the name field

Example fix

// before
{"deny_rules": [{"matches": [...], "requires": {...}}]}
// after
{"name": "my-authz-policy", "deny_rules": [{"matches": [...], "requires": {...}}]}

JsonObject o = JsonParser.parseString(policyJson).getAsJsonObject();
if (!o.has("name") || o.get("name").isJsonNull() || o.get("name").getAsString().isEmpty()) {
  throw new IllegalArgumentException("policy requires non-empty 'name'");
}

static boolean hasNonEmptyName(Map<String, ?> json) {
  Object n = json.get("name");
  return n instanceof String && !((String) n).isEmpty();
}

try {
  List<RBAC> rbacs = AuthorizationPolicyTranslator.translate(policyJson);
} catch (IllegalArgumentException e) {
  if (e.getMessage().contains("name")) { /* fix policy file */ }
  throw e;
}

When it happens

Trigger: Calling AuthorizationPolicyTranslator.translate(policyJson) where the JSON object has no "name" key, or "name": null, or "name": "".

Common situations: Hand-written policy files omitting the required name field, policies copied from examples that strip metadata, programmatic JSON built without setting name.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• "allow_rules" is absent
• "key" is absent or empty
• "values" is absent or empty
• rule "name" is absent or empty
• Authorization policy should be a JSON object. Found: null

AI-assisted analysis of grpc/grpc-java@64daddc1f3 (2026-09-08). Data as JSON: /api/errors/95594edcf14fe00b. Report an issue: GitHub.