apache/dolphinscheduler · warning · ServiceException

USER_NO_OPERATION_PERM

USER_NO_OPERATION_PERM

Error message

Status.USER_NO_OPERATION_PERM

What it means

USER_NO_OPERATION_PERM is thrown by createEnvironment when canOperatorPermissions denies the calling user ENVIRONMENT authorization for the ENVIRONMENT_CREATE function. Only users with environment-management permission (typically ADMIN, or users explicitly granted ENVIRONMENT auth) may create environments. The request fails authorization before any parameter validation.

Solutions

1. Use an admin account, or ask an admin to grant the user ENVIRONMENT authorization.
2. Update automation/CI credentials to an account with environment-management permission.
3. Check which user the sessionId/token actually belongs to — reused sessions often run as the wrong account.
4. If environments should be user-creatable, adjust the deployment's permission policy/grants accordingly.

if (loginUser == null || loginUser.getUserType() != UserType.ADMIN_USER) {
    throw new SecurityException("environment creation requires ENVIRONMENT authorization / admin role");
}

boolean canCreateEnvironment(User u) {
    return u != null && u.getUserType() == UserType.ADMIN_USER;
}

try {
    envService.createEnvironment(user, name, config, desc, workerGroups);
} catch (ServiceException e) {
    if (e.getCode() == Status.USER_NO_OPERATION_PERM) {
        // do not retry: escalate to an admin or use an authorized service account
    }
}

When it happens

Trigger: POST /dolphinscheduler/environments (createEnvironment) with a non-admin user or a service token lacking ENVIRONMENT authorization; SECURITY settings require admin role for environment creation and the caller is a regular/tenant user.

Common situations: Regular users attempting to create environments via API/UI; CI scripts running with a non-admin token; after an upgrade where environment management became admin-only and old automation broke.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• 30001
• 30001
• RESOURCE_NOT_EXIST_OR_NO_PERMISSION
• USER_NO_OPERATION_PERM
• USER_NO_OPERATION_PERM

AI-assisted analysis of apache/dolphinscheduler@02eac45a1b (2026-09-06). Data as JSON: /api/errors/03056ad1fc5de245. Report an issue: GitHub.

Appendix: source

Thrown at dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/EnvironmentServiceImpl.java:102

    /**
     * create environment
     *
     * @param loginUser login user
     * @param name environment name
     * @param config environment config
     * @param desc environment desc
     * @param workerGroups worker groups
     */
    @Override
    @Transactional
    public Long createEnvironment(User loginUser,
                                  String name,
                                  String config,
                                  String desc,
                                  String workerGroups) {
        if (!canOperatorPermissions(loginUser, null, AuthorizationType.ENVIRONMENT, ENVIRONMENT_CREATE)) {
            throw new ServiceException(Status.USER_NO_OPERATION_PERM);
        }
        if (checkDescriptionLength(desc)) {
            throw new ServiceException(Status.DESCRIPTION_TOO_LONG_ERROR);
        }
        checkParams(name, config, workerGroups);

        Environment environment = environmentMapper.queryByEnvironmentName(name);
        if (environment != null) {
            throw new ServiceException(Status.ENVIRONMENT_NAME_EXISTS, name);
        }

        Environment env = new Environment();
        env.setName(name);
        env.setConfig(config);
        env.setDescription(desc);
        env.setOperator(loginUser.getId());
        env.setCreateTime(new Date());
        env.setUpdateTime(new Date());

View on GitHub (pinned to 02eac45a1b)