What causes "The current user does not have this permission." in apache/dolphinscheduler?

Grant the user TASK_GROUP permission for that task group in the security center (authorize task group to user).

apache/dolphinscheduler · error · ServiceException

1400001

1400001

Error message

The current user does not have this permission.

What it means

Thrown by TaskGroupServiceImpl.closeTaskGroup when canOperatorPermissions fails for AuthorizationType.TASK_GROUP and the TASK_GROUP_CLOSE function id. Only users granted the TASK_GROUP authorization for the resource (or admins) may close a task group. Reported as Status.NO_CURRENT_OPERATING_PERMISSION (code 1400001).

Source

Thrown at dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/TaskGroupServiceImpl.java:209

    public TaskGroup queryTaskGroupById(User loginUser, int id) {
        return taskGroupMapper.selectById(id);
    }

    @Override
    public PageInfo<TaskGroup> doQuery(User loginUser, int pageNo, int pageSize, int userId, String name,
                                       Integer status) {
        Page<TaskGroup> page = new Page<>(pageNo, pageSize);
        IPage<TaskGroup> taskGroupPaging =
                taskGroupMapper.queryTaskGroupPaging(page, name, status);

        return buildPageInfo(pageNo, pageSize, taskGroupPaging);
    }

    @Override
    public void closeTaskGroup(User loginUser, int id) {
        if (!canOperatorPermissions(loginUser, null, AuthorizationType.TASK_GROUP,
                ApiFuncIdentificationConstant.TASK_GROUP_CLOSE)) {
            throw new ServiceException(Status.NO_CURRENT_OPERATING_PERMISSION);
        }
        TaskGroup taskGroup = taskGroupMapper.selectById(id);
        if (taskGroup.getStatus() == Flag.NO) {
            log.info("Task group has been closed, taskGroupId:{}.", id);
            throw new ServiceException(Status.TASK_GROUP_STATUS_CLOSED);
        }
        taskGroup.setStatus(Flag.NO);
        if (taskGroupMapper.updateById(taskGroup) > 0) {
            log.info("Task group close complete, taskGroupId:{}.", id);
        } else {
            log.error("Task group close error, taskGroupId:{}.", id);
        }
    }

    @Override
    public void startTaskGroup(User loginUser, int id) {
        if (!canOperatorPermissions(loginUser, null, AuthorizationType.TASK_GROUP,
                ApiFuncIdentificationConstant.TASK_GROUP_CLOSE)) {

View on GitHub (pinned to 02eac45a1b)

Solutions

Grant the user TASK_GROUP permission for that task group in the security center (authorize task group to user).
Log in as an admin user to perform the close.
Check the function identifier ApiFuncIdentificationConstant.TASK_GROUP_CLOSE permission rules if a custom auth plugin is in play.
Verify the caller's userType and authorization relationships in the DB before calling the API.

Example fix

// caller-side check before invoking the API
if (loginUser.getUserType() != UserType.ADMIN_USER && !hasTaskGroupPerm(loginUser, taskGroupId)) {
    throw new ServiceException(Status.NO_CURRENT_OPERATING_PERMISSION);
}
closeTaskGroup(loginUser, taskGroupId);

Defensive patterns

Strategy: validation

Validate before calling

// Java: pre-check authorization before calling close
boolean allowed = loginUser.getUserType() == UserType.ADMIN_USER
        || permissionCheck.checkAdmin(ApiFuncIdentificationConstant.TASK_GROUP_CLOSE, loginUser, AuthorizationType.TASK_GROUP);
if (!allowed) throw new ServiceException(Status.NO_CURRENT_OPERATING_PERMISSION);

Type guard

boolean canCloseTaskGroup(User loginUser) {
    return loginUser != null && loginUser.getUserType() == UserType.ADMIN_USER;
}

Try / catch

try {
    taskGroupService.closeTaskGroup(loginUser, id);
} catch (ServiceException e) {
    if (e.getCode() == 1400001) {
        // request TASK_GROUP permission or fall back to an admin account
    }
    throw e;
}

Prevention

Grant TASK_GROUP authorization to every account that must manage task groups.
Prefer admin or owner accounts for task group lifecycle operations in automation.
Verify permission grants after role changes or user migrations.
Keep UI in sync with granted permissions to avoid surfacing actions users cannot take.

When it happens

Trigger: A non-admin user calls POST /task-group/close with a task group id on which they hold no TASK_GROUP permission, or without any task group authorization granted via the security center.

Common situations: Regular project users trying to manage task groups created by another user; missing authorization entry in t_ds_relation_user_taskgroup-style task group permissions; using a service account without the right role assignment.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

AI-assisted analysis of apache/dolphinscheduler@02eac45a1b (2026-09-06). Data as JSON: /api/errors/d693ff38d69abffb. Report an issue: GitHub.