What causes "user has no operation privilege" in apache/dolphinscheduler?

Log in as or elevate the user to a role with TENANT management permission

apache/dolphinscheduler · error · ServiceException

30001

30001

Error message

user has no operation privilege

What it means

createTenant first checks canOperatorPermissions(loginUser, null, AuthorizationType.TENANT, TENANT_CREATE); users lacking tenant-management privileges get USER_NO_OPERATION_PERM (code 30001). This is an RBAC authorization guard, not an authentication failure.

Source

Thrown at dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/TenantServiceImpl.java:139

    }

    /**
     * create tenant
     *
     * @param loginUser login user
     * @param tenantCode tenant code
     * @param queueId queue id
     * @param desc description
     * @return create result code
     */
    @Override
    @Transactional(rollbackFor = Exception.class)
    public Tenant createTenant(User loginUser,
                               String tenantCode,
                               int queueId,
                               String desc) {
        if (!canOperatorPermissions(loginUser, null, AuthorizationType.TENANT, TENANT_CREATE)) {
            throw new ServiceException(Status.USER_NO_OPERATION_PERM);
        }
        if (checkDescriptionLength(desc)) {
            throw new ServiceException(Status.DESCRIPTION_TOO_LONG_ERROR);
        }
        Tenant tenant = new Tenant(tenantCode, desc, queueId);
        createTenantValid(tenant);
        tenantDao.insert(tenant);

        return tenant;
    }

    /**
     * query tenant list paging
     *
     * @param loginUser login user
     * @param searchVal search value
     * @param pageNo    page number
     * @param pageSize  page size

View on GitHub (pinned to 02eac45a1b)

Solutions

Log in as or elevate the user to a role with TENANT management permission
Have an admin grant the TENANT create authorization to the user's role
Use a service account with tenant-admin privileges for automation

Defensive patterns

Strategy: try-catch

Validate before calling

boolean canCreate = user.getUserType() == UserType.ADMIN_USER;

Try / catch

try { tenantService.createTenant(user, code, queueId, desc); } catch (ServiceException e) { if (e.getCode() == 30001) { throw new SecurityException("TENANT create permission required"); } }

Prevention

Confirm the account's role grants TENANT authorization before automating
Use admin/service accounts for tenant lifecycle operations
Check permissions in the UI security center first

When it happens

Trigger: POST /dolphinscheduler/tenants/create by a logged-in user without TENANT create permission in their role.

Common situations: Regular (non-admin) users attempting tenant creation; roles missing the TENANT authorization scope; calling the API directly with a low-privilege sessionId cookie.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

AI-assisted analysis of apache/dolphinscheduler@02eac45a1b (2026-09-06). Data as JSON: /api/errors/6326a5f735f6a2d9. Report an issue: GitHub.