apache/dolphinscheduler · error · ServiceException

USER_NO_OPERATION_PERM

USER_NO_OPERATION_PERM

Error message

Status.USER_NO_OPERATION_PERM

What it means

Thrown by connectionTest when the caller is not permitted to operate on the data source. canOperatorPermissions rejects the DATASOURCE function for this user, raising Status.USER_NO_OPERATION_PERM before the connectivity check runs.

Source

Thrown at dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/DataSourceServiceImpl.java:292

        DataSourceProcessor sshDataSourceProcessor = DataSourceUtils.getDatasourceProcessor(type);
        boolean connectivity = sshDataSourceProcessor.checkDataSourceConnectivity(connectionParam);
        if (connectivity) {
            return;
        }
        throw new ServiceException(Status.CONNECTION_TEST_FAILURE);
    }

    @Override
    public void connectionTest(User loginUser, int id) {
        DataSource dataSource = dataSourceDao.queryById(id);

        if (dataSource == null) {
            throw new ServiceException(Status.RESOURCE_NOT_EXIST);
        }

        if (!canOperatorPermissions(loginUser, new Object[]{id}, AuthorizationType.DATASOURCE,
                ApiFuncIdentificationConstant.DATASOURCE)) {
            throw new ServiceException(Status.USER_NO_OPERATION_PERM);
        }

        checkConnection(dataSource.getType(),
                DataSourceUtils.buildConnectionParams(dataSource.getType(), dataSource.getConnectionParams()));
    }

    @Override
    @Transactional
    public void delete(User loginUser, int datasourceId) {
        // query datasource by id
        DataSource dataSource = dataSourceDao.queryById(datasourceId);

        if (dataSource == null) {
            throw new ServiceException(Status.RESOURCE_NOT_EXIST);
        }

        if (!canOperatorPermissions(loginUser, new Object[]{datasourceId}, AuthorizationType.DATASOURCE,
                DATASOURCE_DELETE)) {

View on GitHub (pinned to 02eac45a1b)

Solutions

  1. Grant the user access to the data source via Security Center > Data Source Authorize
  2. Perform the test as an admin or the data source owner
  3. Re-login after permission changes to refresh grants
  4. Check the authorization type/user mapping in t_ds_user and t_relation_datasource_user

Example fix

// before
connectionTest(nonOwner, dsId); // 30001
// after
grantDatasourceToUser(dsId, nonOwner.getId()); // admin action
connectionTest(nonOwner, dsId);
Defensive patterns

Strategy: try-catch

Validate before calling

boolean authorized = loginUser.getUserType() == UserType.ADMIN_USER
    || authorizedDatasourceService.getAuthorizedDatasource(loginUser, userId)
        .stream().anyMatch(ds -> ds.getId() == id);

Try / catch

try { service.connectionTest(user, id); } catch (ServiceException e) { if (e.getCode() == 30001) { requestAuthorization(id); } throw e; }

Prevention

When it happens

Trigger: POST /datasources/{id}/connect by a user who neither created the data source nor had it authorized to them.

Common situations: Service account testing a data source owned by another team; user session whose grants were revoked; non-admin calling admin-scope test endpoints.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

AI-assisted analysis of apache/dolphinscheduler@02eac45a1b (2026-09-06). Data as JSON: /api/errors/d7c406b35b639113. Report an issue: GitHub.