apache/druid · error · ForbiddenException

The current user[%s] cannot view query id[%s] since the quer

Error message

The current user[%s] cannot view query id[%s] since the query is owned by another user

What it means

Thrown by the MSQ SQL statement REST resource when a user requests status/results of a query they do not own and the authorization check for the STATE resource fails. Druid restricts MSQ query introspection to the submitting user (or users with explicit STATE READ permissions), so cross-user access is rejected with HTTP 403.

Source

Thrown at multi-stage-query/src/main/java/org/apache/druid/msq/sql/resources/SqlStatementResource.java:734

    MSQControllerTask msqControllerTask = (MSQControllerTask) taskPayloadResponse.getPayload();
    String queryUser = String.valueOf(msqControllerTask.getQuerySpec()
                                                       .getContext()
                                                       .get(MSQTaskQueryMaker.USER_KEY));

    String currentUser = authenticationResult.getIdentity();

    if (currentUser != null && currentUser.equals(queryUser)) {
      return msqControllerTask;
    }

    AuthorizationResult authResult = AuthorizationUtils.authorizeAllResourceActions(
        authenticationResult,
        Collections.singletonList(new ResourceAction(Resource.STATE_RESOURCE, forAction)),
        authorizerMapper
    );

    if (!authResult.allowAccessWithNoRestriction()) {
      throw new ForbiddenException(StringUtils.format(
          "The current user[%s] cannot view query id[%s] since the query is owned by another user",
          currentUser,
          queryId
      ));
    }

    return msqControllerTask;
  }

  private ResultFormat getPreferredResultFormat(String resultFormatParam, MSQSpec msqSpec)
  {
    if (resultFormatParam == null) {
      return QueryContexts.getAsEnum(
          RESULT_FORMAT,
          msqSpec.getContext().get(RESULT_FORMAT),
          ResultFormat.class,
          ResultFormat.DEFAULT_RESULT_FORMAT
      );

View on GitHub (pinned to 9b90983fd2)

Solutions

Query the id with the same user that submitted the query, or re-submit the query under your own account
Grant the current user READ on Resource.STATE_RESOURCE via the authorizer (e.g. add a STATE resource rule/role for the ops role)
Check which identity reached the endpoint (authenticat result) — proxy headers or tiered auth may map the request to an unintended user
If admins should see all queries, configure the authorizer to allow STATE READ for the appropriate role

Example fix

// before: admin cannot view others' queries
GET /druid/v2/sql/statements/{id} -> 403 Forbidden
// after: grant STATE READ in authorizer.json role
"role-ops": {"resources": [{"name": "STATE", "type": "STATE", "actions": ["READ"]}], "statePermissions": {"queries": "READ"}}

Defensive patterns

Strategy: validation

Validate before calling

// client-side: query the statement's status only as the submitting user
if (!currentUser.equals(statement.getQueryContext().get("authUser"))) {
  throw new IllegalStateException("Query owned by another user; STATE READ required");
}

Prevention

Submit and query MSQ statements under a consistent service account
Grant ops/admin roles STATE READ in the authorizer
Be aware of proxy authentication mapping the request to a different identity

When it happens

Trigger: Calling GET /druid/v2/sql/statements/{queryId} (or its status/results endpoints) as user A when the query was submitted by user B and the authorizer does not grant A read access to the STATE resource.

Common situations: Shared clusters where an operator tries to inspect a colleague's query; service accounts querying with a different identity than the UI session; missing STATE READ permission for admin/ops roles after authorizer configuration changes.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

AI-assisted analysis of apache/druid@9b90983fd2 (2026-09-07). Data as JSON: /api/errors/8a41d5339a73d768. Report an issue: GitHub.