apache/hadoop · error · RuntimeException

Access denied: User {} does not have permission to view job

Error message

Access denied: User {} does not have permission to view job {}

What it means

After resolving the job, requireJob checks JobACL.VIEW_JOB: when the authenticated remote user is not the job owner, not listed in mapreduce.job.acl-view-job, and not an admin, the UI sends 403 (accessDenied) and throws this RuntimeException to stop rendering. Unauthenticated requests are not checked here - they fail earlier at authentication.

Source

Thrown at hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-app/src/main/java/org/apache/hadoop/mapreduce/v2/app/webapp/AppController.java:427

  public void requireJob() {
    if ($(JOB_ID).isEmpty()) {
      badRequest("missing job ID");
      throw new RuntimeException("Bad Request: Missing job ID");
    }

    JobId jobID = MRApps.toJobID($(JOB_ID));
    app.setJob(app.context.getJob(jobID));
    if (app.getJob() == null) {
      notFound($(JOB_ID));
      throw new RuntimeException("Not Found: " + $(JOB_ID));
    }

    /* check for acl access */
    Job job = app.context.getJob(jobID);
    if (!checkAccess(job)) {
      accessDenied("User " + request().getRemoteUser() + " does not have " +
          " permission to view job " + $(JOB_ID));
      throw new RuntimeException("Access denied: User " +
          request().getRemoteUser() + " does not have permission to view job " +
          $(JOB_ID));
    }
  }

  /**
   * Ensure that a TASK_ID was passed into the page.
   */
  public void requireTask() {
    if ($(TASK_ID).isEmpty()) {
      badRequest("missing task ID");
      throw new RuntimeException("missing task ID");
    }

    TaskId taskID = MRApps.toTaskID($(TASK_ID));
    Job job = app.context.getJob(taskID.getJobId());
    app.setJob(job);
    if (app.getJob() == null) {

View on GitHub (pinned to 2add963021)

Solutions

1. Ask the job owner to add your user to mapreduce.job.acl-view-job at submission time
2. Access the page as the job owner or a cluster/queue administrator
3. For completed jobs, view them through the Job History Server with admin rights

Example fix

// before: submitted without view ACL
Job job = Job.getInstance(conf);

// after: owner grants view access at submission
Job job = Job.getInstance(conf);
job.getConfiguration().set("mapreduce.job.acl-view-job", "alice,ops-team");

// UI-side (scrapers): detect the 403 and report a permission problem
try {
  page = fetch(amUrl + "/job?job.id=" + jobId);
} catch (HttpStatusException e) {
  if (e.getStatusCode() == 403) {
    throw new AccessDeniedException(
        "no VIEW_JOB acl for " + currentUser + " on " + jobId
        + " - ask the owner to add you to mapreduce.job.acl-view-job");
  }
  throw e;
}

When it happens

Trigger: An SPNEGO/Kerberos-authenticated user opens a job page of an ACL-protected job without view permission: checkAccess(job) returned false in AppController.requireJob (AppController.java:423-428).

Common situations: Shared clusters with per-job view ACLs; operators not in mapreduce.cluster.acl.administer; secure clusters where the browser authenticates as a different principal than the one granted access.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• User:%s not allowed to do '%s' on '%s'
• User {} cannot perform operation {} on {}
• missing task-type.
• missing attempt-state.
• Bad Request: Missing job ID

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/7e3ccf65ba1f9a12. Report an issue: GitHub.