apache/dolphinscheduler · error · ServiceException

30001

30001

Error message

user has no operation privilege

What it means

Status.USER_NO_OPERATION_PERM (30001) in WorkerGroupServiceImpl.saveWorkerGroup is thrown when the login user lacks WORKER_GROUP create/update permission (canOperatorPermissions with AuthorizationType.WORKER_GROUP and WORKER_GROUP_CREATE fails). Only authorized admins/managers may create or modify worker groups.

Source

Thrown at dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/WorkerGroupServiceImpl.java:118

    /**
     * create or update a worker group
     *
     * @param loginUser login user
     * @param id        worker group id
     * @param name      worker group name
     * @param addrList  addr list
     * @return create or update result code
     */
    @Override
    public WorkerGroup saveWorkerGroup(User loginUser,
                                       int id,
                                       String name,
                                       String addrList,
                                       String description) {
        if (!canOperatorPermissions(loginUser, null, AuthorizationType.WORKER_GROUP, WORKER_GROUP_CREATE)) {
            // todo: add permission exception
            throw new ServiceException(Status.USER_NO_OPERATION_PERM);
        }
        if (StringUtils.isEmpty(name)) {
            throw new ServiceException(Status.NAME_NULL);
        }
        checkWorkerGroupAddrList(addrList);
        final Date now = new Date();
        final WorkerGroup workerGroup;
        try {
            if (id == 0) {
                // insert
                workerGroup = new WorkerGroup();
                workerGroup.setCreateTime(now);
                workerGroup.setName(name);
                workerGroup.setAddrList(addrList);
                workerGroup.setUpdateTime(now);
                workerGroup.setDescription(description);
                workerGroupDao.insert(workerGroup);
            } else {

View on GitHub (pinned to 02eac45a1b)

Solutions

1. Use an account with worker-group management authorization (typically admin).
2. Grant the user WORKER_GROUP authorization via the security/permission management APIs.
3. Verify the session/token is for the intended (privileged) user, not a stale or wrong one.
4. In client code, hide/disable worker-group edit UI unless the user has the permission.

Example fix

// before
workerGroupService.saveWorkerGroup(devUser, 0, "grp", "ip:1234", ""); // 30001
// after
if (isAdmin(loginUser)) {
    workerGroupService.saveWorkerGroup(loginUser, 0, "grp", "ip:1234", "");
}

boolean allowed = loginUser.getUserType() == UserType.ADMIN_USER;
if (!allowed) { throw new SecurityException("WORKER_GROUP_CREATE permission required"); }

try {
    workerGroupService.saveWorkerGroup(loginUser, id, name, addrList, desc);
} catch (ServiceException e) {
    if (e.getCode() == 30001) { /* no worker-group permission */ }
}

When it happens

Trigger: Calling the worker-group save endpoint (create or update) with a user whose permissions do not include worker-group management; permission is checked before name validation, so it fires first for unauthorized users.

Common situations: Non-admin UI users opening the worker-group page and submitting; automation tokens scoped to a project without worker-group authorization; role changes that removed WORKER_GROUP grant.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• USER_NO_OPERATION_PERM
• 30001
• USER_NO_OPERATION_PERM
• USER_NO_OPERATION_PERM
• RESOURCE_NOT_EXIST_OR_NO_PERMISSION

AI-assisted analysis of apache/dolphinscheduler@02eac45a1b (2026-09-06). Data as JSON: /api/errors/364ec4324172da77. Report an issue: GitHub.