apache/dolphinscheduler · error · ServiceException

30001

30001

Error message

user has no operation privilege

What it means

createDataSource first checks authorization via canOperatorPermissions for AuthorizationType.DATASOURCE and the DATASOURCE_CREATE_DATASOURCE function tag. If the login user lacks permission (admin, or authorized datasource-level grants), Status.USER_NO_OPERATION_PERM (code 30001) is thrown.

Source

Thrown at dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/DataSourceServiceImpl.java:92

    @Autowired
    private DataSourceDao dataSourceDao;

    @Autowired
    private DataSourceUserDao datasourceUserDao;

    private static final String TABLE = "TABLE";
    private static final String VIEW = "VIEW";
    private static final String[] TABLE_TYPES = new String[]{TABLE, VIEW};
    private static final String TABLE_NAME = "TABLE_NAME";
    private static final String COLUMN_NAME = "COLUMN_NAME";

    @Override
    public DataSource createDataSource(User loginUser, BaseDataSourceParamDTO datasourceParam) {
        DataSourceUtils.checkDatasourceParam(datasourceParam);
        if (!canOperatorPermissions(loginUser, null, AuthorizationType.DATASOURCE,
                ApiFuncIdentificationConstant.DATASOURCE_CREATE_DATASOURCE)) {
            throw new ServiceException(Status.USER_NO_OPERATION_PERM);
        }
        // check name can use or not
        if (checkName(datasourceParam.getName())) {
            throw new ServiceException(Status.DATASOURCE_EXIST);
        }
        if (checkDescriptionLength(datasourceParam.getNote())) {
            throw new ServiceException(Status.DESCRIPTION_TOO_LONG_ERROR);
        }
        ConnectionParam connectionParam = DataSourceUtils.buildConnectionParams(datasourceParam);

        // build datasource
        DataSource dataSource = new DataSource();
        Date now = new Date();

        dataSource.setName(datasourceParam.getName().trim());
        dataSource.setNote(datasourceParam.getNote());
        dataSource.setUserId(loginUser.getId());
        dataSource.setUserName(loginUser.getUserName());

View on GitHub (pinned to 02eac45a1b)

Solutions

  1. Log in as an admin or use an account granted DATASOURCE authorization.
  2. In the security UI, grant the user datasource permissions (or the relevant function tag).
  3. Verify the Authorization/token header actually belongs to the intended privileged user.

Example fix

// before
curl -H "X-Token: <readonlyUserToken>" -X POST .../datasources -d '{...}'
// after
curl -H "X-Token: <adminOrDatasourceGrantedUserToken>" -X POST .../datasources -d '{...}'
Defensive patterns

Strategy: try-catch

Validate before calling

// verify user's datasource permissions before calling
boolean canCreate = user.isAdmin() || user.getAuthorizedDatasources() != null;

Try / catch

try { api.createDataSource(user, param); } catch (ServiceException e) { if (e.getCode() == 30001) { throw new SecurityException("user lacks datasource create permission", e); } throw e; }

Prevention

When it happens

Trigger: POST /datasources with a user token whose roles/grants do not include datasource creation rights (non-admin user with no DATASOURCE authorization).

Common situations: CI jobs using a read-only service account; users added to a project without datasource permissions; token of a revoked/deactivated admin.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

AI-assisted analysis of apache/dolphinscheduler@02eac45a1b (2026-09-06). Data as JSON: /api/errors/82dd9893afc15077. Report an issue: GitHub.