apache/hadoop · error · UnsupportedOperationException

GetAclStatus operation is only supported on HNS enabled Acco

Error message

GetAclStatus operation is only supported on HNS enabled Accounts.

What it means

AbfsBlobClient.getAclStatus is a stub for non-HNS accounts and always throws UnsupportedOperationException('GetAclStatus operation is only supported on HNS enabled Accounts.'). Reading named ACLs requires hierarchical namespace; flat-namespace accounts have no per-path ACL to return, so even read access fails client-side.

Source

Thrown at hadoop-tools/hadoop-azure/src/main/java/org/apache/hadoop/fs/azurebfs/services/AbfsBlobClient.java:1474

      final TracingContext tracingContext) throws AzureBlobFileSystemException {
    throw new UnsupportedOperationException(
        "SetAcl operation is only supported on HNS enabled Accounts.");
  }

  /**
   * Get the ACL of the file or directory.
   * Not supported for HNS-Disabled Accounts.
   * @param path of which properties have to be fetched.
   * @param useUPN whether to use UPN with rest operation.
   * @param tracingContext for tracing the server calls.
   * @return exception as this operation is not supported on Blob Endpoint.
   * @throws UnsupportedOperationException always.
   */
  @Override
  public AbfsRestOperation getAclStatus(final String path,
      final boolean useUPN,
      TracingContext tracingContext) throws AzureBlobFileSystemException {
    throw new UnsupportedOperationException(
        "GetAclStatus operation is only supported on HNS enabled Accounts.");
  }

  /**
   * Check the access of the file or directory.
   * Not supported for HNS-Disabled Accounts.
   * @param path  Path for which access check needs to be performed
   * @param rwx   The permission to be checked on the path
   * @param tracingContext Tracks identifiers for request header
   * @return exception as this operation is not supported on Blob Endpoint.
   * @throws UnsupportedOperationException always.
   */
  @Override
  public AbfsRestOperation checkAccess(String path,
      String rwx,
      TracingContext tracingContext) throws AzureBlobFileSystemException {
    throw new UnsupportedOperationException(
        "CheckAccess operation is only supported on HNS enabled Accounts.");

View on GitHub (pinned to 2add963021)

Solutions

  1. Enable HNS on the account when ACL introspection is required
  2. Feature-detect and skip getAclStatus for non-HNS filesystems in shared tooling
  3. Model flat-namespace access with Azure RBAC role assignments instead of per-path ACLs

Example fix

// before
AclStatus st = fs.getAclStatus(path);

// after
if (isHnsAccount(fs)) {
  AclStatus st = fs.getAclStatus(path);
} else {
  // no per-path ACLs exist on this account
}
Defensive patterns

Strategy: validation

Validate before calling

AclStatus st = isHnsAccount(fs)
    ? fs.getAclStatus(path)
    : null; // no per-path ACLs exist on non-HNS accounts

Type guard

private static boolean supportsAclStatus(FileSystem fs) {
  return !(fs instanceof AzureBlobFileSystem)
      || fs.getConf().getBoolean("fs.azure.account.hns.enabled", false);
}

Try / catch

try {
  return fs.getAclStatus(path);
} catch (UnsupportedOperationException e) {
  // non-HNS account: report "no ACL information available" instead of failing
  return new AclStatus.Builder().build();
}

Prevention

When it happens

Trigger: Calling fs.getAclStatus(path) on an abfs:// URI backed by an account with hierarchical namespace disabled — e.g. audit tooling, distcp -p querying source ACLs, or code that inspects ACLs before copying.

Common situations: Compliance/audit scripts iterating all mounted filesystems; backup tools that snapshot ACLs; permission-preserving copies probing target capabilities.

Related errors

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/39eb9abe8b21ea39. Report an issue: GitHub.