apache/dolphinscheduler · error · ServiceException

USER_NO_OPERATION_PERM

USER_NO_OPERATION_PERM

Error message

USER_NO_OPERATION_PERM: user has no operation permission

What it means

USER_NO_OPERATION_PERM is thrown in createQueue when canOperatorPermissions(loginUser, null, AuthorizationType.QUEUE, YARN_QUEUE_CREATE) returns false, i.e. the logged-in user lacks the permission bit needed to manage YARN queues. The service refuses the operation before any validation or insert.

Source

Thrown at dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/QueueServiceImpl.java:166

        IPage<Queue> queueList = queueDao.queryQueuePaging(page, new ArrayList<>(ids), searchVal);
        Integer count = (int) queueList.getTotal();
        pageInfo.setTotal(count);
        pageInfo.setTotalList(queueList.getRecords());
        return pageInfo;
    }

    /**
     * create queue
     *
     * @param loginUser login user
     * @param queue     queue
     * @param queueName queue name
     * @return create result
     */
    @Override
    public Queue createQueue(User loginUser, String queue, String queueName) {
        if (!canOperatorPermissions(loginUser, null, AuthorizationType.QUEUE, YARN_QUEUE_CREATE)) {
            throw new ServiceException(Status.USER_NO_OPERATION_PERM);
        }

        Queue queueObj = new Queue(queueName, queue);
        validQueue(queueObj);
        queueDao.insert(queueObj);

        return queueObj;
    }

    /**
     * update queue
     *
     * @param loginUser login user
     * @param queue     queue
     * @param id        queue id
     * @param queueName queue name
     * @return update result code
     */

View on GitHub (pinned to 02eac45a1b)

Solutions

  1. Log in as a user with QUEUE management permission (typically ADMIN)
  2. Grant the user QUEUE authorization via the permission management APIs/UI
  3. Use a dedicated admin service account for queue automation

Example fix

// before
queueService.createQueue(tenantUser, "default", "DefaultQueue"); // no perm
// after
if (canOperatorPermissions(loginUser, null, AuthorizationType.QUEUE, YARN_QUEUE_CREATE)) {
    queueService.createQueue(loginUser, "default", "DefaultQueue");
}
Defensive patterns

Strategy: try-catch

Validate before calling

boolean allowed = canOperatorPermissions(loginUser, null, AuthorizationType.QUEUE, YARN_QUEUE_CREATE);
if (!allowed) {
    throw new IllegalStateException("User " + loginUser.getUserName() + " lacks QUEUE create permission");
}

Try / catch

try {
    queueService.createQueue(loginUser, queue, queueName);
} catch (ServiceException e) {
    if (e.getCode() == Status.USER_NO_OPERATION_PERM.getCode()) { /* escalate role or use admin account */ }
    throw e;
}

Prevention

When it happens

Trigger: A non-admin user calling the queue-create REST endpoint; a service account whose role was downgraded; API tokens issued for a user without QUEUE authorization type permissions.

Common situations: Calling admin-only queue management APIs from tenant-level automation; role changes after reorganizing DolphinScheduler permission groups; using the wrong user's session/token in CI scripts.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

AI-assisted analysis of apache/dolphinscheduler@02eac45a1b (2026-09-06). Data as JSON: /api/errors/136ec754f799e3fa. Report an issue: GitHub.