apache/dolphinscheduler · error · ServiceException

1400001

1400001

Error message

The current user does not have this permission.

What it means

ServiceException(Status.NO_CURRENT_OPERATING_PERMISSION, code 1400001) is thrown in grantProjectWithReadPerm when the login user is not an administrator. Only admins may grant read permission on projects to other users; the isAdmin(loginUser) check fails before any lookup or grant happens. It is an authorization failure on the caller's identity, independent of the target user or projects.

Solutions

1. Log in as (or use a token of) an admin user before calling this API.
2. Grant the ADMIN_USER user type to the account in Users management if it legitimately needs this duty.
3. Change the workflow so regular users request grants through an admin-approved path instead of calling the admin endpoint.
4. Check the caller's role in your client code and fail fast with a clear message.

Example fix

// before
usersService.grantProjectWithReadPerm(currentUser, userId, projectIds); // throws if currentUser is not admin
// after
if (!LoginUserTypeChecker.isAdmin(currentUser)) {
    throw new SecurityException("Admin privileges required to grant project read permission");
}
usersService.grantProjectWithReadPerm(currentUser, userId, projectIds);

if (loginUser == null || loginUser.getUserType() != UserType.ADMIN_USER) {
    throw new SecurityException("grantProjectWithReadPerm requires an admin user");
}

boolean isAdminUser(User u) { return u != null && u.getUserType() == UserType.ADMIN_USER; }

try {
    usersService.grantProjectWithReadPerm(loginUser, userId, projectIds);
} catch (ServiceException e) {
    if (e.getCode() == 1400001) { /* not admin: switch to admin credentials */ }
    else throw e;
}

When it happens

Trigger: Calling grantProjectWithReadPerm(loginUser, userId, projectIds) while loginUser has USER_TYPE.GENERAL_USER instead of ADMIN_USER.

Common situations: A regular user's session/token is used to call the admin-only grant REST endpoint; role downgraded after token issued; service account lacks admin role in a CI script.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

• 130020
• 1400001
• 20016
• 30001
• 30001

AI-assisted analysis of apache/dolphinscheduler@02eac45a1b (2026-09-06). Data as JSON: /api/errors/a4f1b1e022ea89f4. Report an issue: GitHub.

Appendix: source

Thrown at dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/UsersServiceImpl.java:501

                // 4. delete the relationship between project and user
                this.projectUserDao.deleteProjectRelation(project.getId(), user.getId());
            }
        });
    }

    /**
     * grant project with read permission
     *
     * @param loginUser  login user
     * @param userId     user id
     * @param projectIds project id array
     * @return grant result code
     */
    @Override
    @Transactional(rollbackFor = RuntimeException.class)
    public void grantProjectWithReadPerm(User loginUser, int userId, String projectIds) {
        if (!isAdmin(loginUser)) {
            throw new ServiceException(Status.NO_CURRENT_OPERATING_PERMISSION);
        }

        // check exist
        User tempUser = userDao.queryById(userId);
        if (tempUser == null) {
            throw new ServiceException(Status.USER_NOT_EXIST, userId);
        }

        if (StringUtils.isEmpty(projectIds)) {
            return;
        }
        Arrays.stream(projectIds.split(Constants.COMMA)).distinct().forEach(projectId -> {
            ProjectUser projectUserOld = projectUserDao.queryProjectRelation(Integer.parseInt(projectId), userId);
            if (projectUserOld != null) {
                projectUserDao.deleteProjectRelation(Integer.parseInt(projectId), userId);
            }
            Date now = new Date();
            ProjectUser projectUser = new ProjectUser();

View on GitHub (pinned to 02eac45a1b)