apache/hadoop · error · AccessControlException

{} is not a super user

Error message

{} is not a super user

What it means

The final fallback in RouterPermissionChecker.checkSuperuserPrivilege: the caller's UGI is neither the router super user (short name equal to the user running the Router, i.e. its owner) nor a member of the super group (dfs.permissions.superusergroup, default 'supergroup'). The AccessControlException names the rejected user, protecting privileged router operations (admin protocol, setSafeMode, refresh calls, mount table writes).

Source

Thrown at hadoop-hdfs-project/hadoop-hdfs-rbf/src/main/java/org/apache/hadoop/hdfs/server/federation/router/RouterPermissionChecker.java:132

      // Ignore as we catch it afterwards
    }
    if (ugi == null) {
      LOG.error("Cannot get the remote user name");
      throw new AccessControlException("Cannot get the remote user name");
    }

    // Is this by the Router user itself?
    if (ugi.getShortUserName().equals(superUser)) {
      return;
    }

    // Is the user a member of the super group?
    if (ugi.getGroupsSet().contains(superGroup)) {
      return;
    }

    // Not a superuser
    throw new AccessControlException(
        ugi.getUserName() + " is not a super user");
  }
}

View on GitHub (pinned to 2add963021)

Solutions

1. Add the user to dfs.permissions.superusergroup (via group mapping - LDAP/OS/static mapping) so the groups set contains the supergroup
2. Or run the privileged operation as the user that owns the router process (its short name matches superUser)
3. Verify effective groups with a groups mapping check (UserGroupInformation.getLoginUser().getGroups()) - stale group cache may need refreshUserToGroupsMappings on the Namenodes
4. If a different admin group is wanted, set dfs.permissions.superusergroup consistently and restart the router

Example fix

# before
hdfs dfsrouteradmin -safemode enter   # as user alice -> 'alice is not a super user'
# after: put alice in the supergroup (example: static mapping in core-site.xml)
<property><name>hadoop.user.group.static.mapping.overrides</name><value>alice=alice,supergroup</value></property>
# or run as the router owner
sudo -u hdfs hdfs dfsrouteradmin -safemode enter

// Verify superuser status client-side before attempting privileged admin calls
UserGroupInformation ugi = UserGroupInformation.getCurrentUser();
String superGroup = conf.get("dfs.permissions.superusergroup", "supergroup");
boolean isSuper = ugi.getShortUserName().equals(routerOwnerShortName)
    || ugi.getGroupsSet().contains(superGroup);
if (!isSuper) throw new AccessControlException(ugi.getUserName() + " is not a super user");

boolean isRouterSuperuser(UserGroupInformation ugi, String routerOwner, String superGroup) {
  return ugi.getShortUserName().equals(routerOwner)
      || ugi.getGroupsSet().contains(superGroup);
}

try {
  client.getRouterStateManager().setSafeMode(SafeModeAction.ENTER, false);
} catch (AccessControlException ace) {
  if (ace.getMessage() != null && ace.getMessage().endsWith("is not a super user")) {
    // put the acting user in dfs.permissions.superusergroup or run as the router owner
  }
  throw ace;
}

When it happens

Trigger: Any router operation gated by checkSuperuserPrivilege - RouterAdminServer mutations, refresh*/setSafeMode, and similar - issued by a user that is not the router process owner and not in the configured supergroup.

Common situations: Ops team members not listed in the supergroup attempting dfsrouteradmin changes; supergroup left at default 'supergroup' which nobody actually belongs to; router run under 'hdfs' while admins use personal accounts; group mapping (LDAP/static mapping) not returning the supergroup for the user.

Related errors

• Permission denied while accessing mount table {}: user {} do
• Permission denied rename {}({}) to {}({}) Reason={}
• Cannot get the remote user name
• No mount point for %s
• Rename of {} to {} is not allowed, no eligible destination i

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/7ab4353282808232. Report an issue: GitHub.