java-native-access/jna · error · IllegalArgumentException

Group PSID is invalid

Error message

Group PSID is invalid

What it means

When setGroup is requested and the group SID is present but Advapi32.IsValidSid rejects it, the library throws IllegalArgumentException ('Group PSID is invalid'), guarding against passing a malformed SID to SetSecurityDescriptor components.

Source

Thrown at contrib/platform/src/com/sun/jna/platform/win32/Advapi32Util.java:2885

        final PSID psidGroup = securityDescriptor.getGroup();
        final ACL dacl = securityDescriptor.getDiscretionaryACL();
        final ACL sacl = securityDescriptor.getSystemACL();

        int infoType = 0;
        // Parameter validation and infoType flag setting.
        if (setOwner) {
            if (psidOwner == null)
                throw new IllegalArgumentException("SECURITY_DESCRIPTOR_RELATIVE does not contain owner");
            if (!Advapi32.INSTANCE.IsValidSid(psidOwner))
                throw new IllegalArgumentException("Owner PSID is invalid");
            infoType |= OWNER_SECURITY_INFORMATION;
        }

        if (setGroup) {
            if (psidGroup == null)
                throw new IllegalArgumentException("SECURITY_DESCRIPTOR_RELATIVE does not contain group");
            if (!Advapi32.INSTANCE.IsValidSid(psidGroup))
                throw new IllegalArgumentException("Group PSID is invalid");
            infoType |= GROUP_SECURITY_INFORMATION;
        }

        if (setDACL) {
            if (dacl == null)
                throw new IllegalArgumentException("SECURITY_DESCRIPTOR_RELATIVE does not contain DACL");
            if (!Advapi32.INSTANCE.IsValidAcl(dacl.getPointer()))
                throw new IllegalArgumentException("DACL is invalid");
            infoType |= DACL_SECURITY_INFORMATION;
        }

        if (setSACL) {
            if (sacl == null)
                throw new IllegalArgumentException("SECURITY_DESCRIPTOR_RELATIVE does not contain SACL");
            if (!Advapi32.INSTANCE.IsValidAcl(sacl.getPointer()))
                throw new IllegalArgumentException("SACL is invalid");
            infoType |= SACL_SECURITY_INFORMATION;
        }

View on GitHub (pinned to d036ad9781)

Solutions

  1. Pre-validate with Advapi32.INSTANCE.IsValidSid(psidGroup) and rebuild the SID if invalid.
  2. Re-parse the descriptor from its full original buffer so the group offset resolves to valid memory.
  3. Replace the hand-built SID with one obtained from LookupAccountName or Advapi32Util helpers.
  4. Skip the group component (setGroup=false) if the group is not essential.

Example fix

// before
Advapi32Util.setSecurityDescriptorComponents(sd, true, true, true, true, false, false);
// after
if (sd.getGroup() != null && Advapi32.INSTANCE.IsValidSid(sd.getGroup())) {
    Advapi32Util.setSecurityDescriptorComponents(sd, true, true, true, true, false, false);
}
Defensive patterns

Strategy: validation

Validate before calling

if (securityDescriptor.getGroup() == null || !Advapi32.INSTANCE.IsValidSid(securityDescriptor.getGroup())) {
    throw new IllegalStateException("Group SID missing or invalid");
}

Type guard

boolean isValidGroup(SECURITY_DESCRIPTOR_RELATIVE sd) {
    return sd.getGroup() != null && Advapi32.INSTANCE.IsValidSid(sd.getGroup());
}

Try / catch

try {
    Advapi32Util.setSecurityDescriptorComponents(sd, false, true, false, false, false, false);
} catch (IllegalArgumentException e) {
    log.error("Group SID rejected: " + e.getMessage());
}

Prevention

When it happens

Trigger: setGroup=true with a non-null but structurally invalid psidGroup: bad revision/sub-authority count, truncated buffer, wrong offset into the descriptor bytes.

Common situations: Manual SID construction from raw bytes; offsets skewed after editing descriptor fields; copying group SIDs between descriptors of different sizes without adjusting offsets.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

AI-assisted analysis of java-native-access/jna@d036ad9781 (2026-09-12). Data as JSON: /api/errors/d1719b7eca7c41d0. Report an issue: GitHub.