apache/dolphinscheduler · warning · ServiceException

USER_NO_OPERATION_PERM

USER_NO_OPERATION_PERM

Error message

Status.USER_NO_OPERATION_PERM

What it means

USER_NO_OPERATION_PERM is thrown by createEnvironment when canOperatorPermissions denies the calling user ENVIRONMENT authorization for the ENVIRONMENT_CREATE function. Only users with environment-management permission (typically ADMIN, or users explicitly granted ENVIRONMENT auth) may create environments. The request fails authorization before any parameter validation.

Source

Thrown at dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/EnvironmentServiceImpl.java:102

    /**
     * create environment
     *
     * @param loginUser login user
     * @param name environment name
     * @param config environment config
     * @param desc environment desc
     * @param workerGroups worker groups
     */
    @Override
    @Transactional
    public Long createEnvironment(User loginUser,
                                  String name,
                                  String config,
                                  String desc,
                                  String workerGroups) {
        if (!canOperatorPermissions(loginUser, null, AuthorizationType.ENVIRONMENT, ENVIRONMENT_CREATE)) {
            throw new ServiceException(Status.USER_NO_OPERATION_PERM);
        }
        if (checkDescriptionLength(desc)) {
            throw new ServiceException(Status.DESCRIPTION_TOO_LONG_ERROR);
        }
        checkParams(name, config, workerGroups);

        Environment environment = environmentMapper.queryByEnvironmentName(name);
        if (environment != null) {
            throw new ServiceException(Status.ENVIRONMENT_NAME_EXISTS, name);
        }

        Environment env = new Environment();
        env.setName(name);
        env.setConfig(config);
        env.setDescription(desc);
        env.setOperator(loginUser.getId());
        env.setCreateTime(new Date());
        env.setUpdateTime(new Date());

View on GitHub (pinned to 02eac45a1b)

Solutions

1. Use an admin account, or ask an admin to grant the user ENVIRONMENT authorization.
2. Update automation/CI credentials to an account with environment-management permission.
3. Check which user the sessionId/token actually belongs to — reused sessions often run as the wrong account.
4. If environments should be user-creatable, adjust the deployment's permission policy/grants accordingly.

if (loginUser == null || loginUser.getUserType() != UserType.ADMIN_USER) {
    throw new SecurityException("environment creation requires ENVIRONMENT authorization / admin role");
}

boolean canCreateEnvironment(User u) {
    return u != null && u.getUserType() == UserType.ADMIN_USER;
}

try {
    envService.createEnvironment(user, name, config, desc, workerGroups);
} catch (ServiceException e) {
    if (e.getCode() == Status.USER_NO_OPERATION_PERM) {
        // do not retry: escalate to an admin or use an authorized service account
    }
}

When it happens

Trigger: POST /dolphinscheduler/environments (createEnvironment) with a non-admin user or a service token lacking ENVIRONMENT authorization; SECURITY settings require admin role for environment creation and the caller is a regular/tenant user.

Common situations: Regular users attempting to create environments via API/UI; CI scripts running with a non-admin token; after an upgrade where environment management became admin-only and old automation broke.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• USER_NO_OPERATION_PERM
• 30001
• USER_NO_OPERATION_PERM
• 30001
• RESOURCE_NOT_EXIST_OR_NO_PERMISSION

AI-assisted analysis of apache/dolphinscheduler@02eac45a1b (2026-09-06). Data as JSON: /api/errors/03056ad1fc5de245. Report an issue: GitHub.