apache/hadoop · error · UnsupportedOperationException

SetAcl operation is only supported on HNS enabled Accounts.

Error message

SetAcl operation is only supported on HNS enabled Accounts.

What it means

On accounts without Hierarchical Namespace, AbfsBlobClient.setAcl is a stub that unconditionally throws UnsupportedOperationException('SetAcl operation is only supported on HNS enabled Accounts.'). POSIX ACLs (named user/group entries, masks, defaults) only exist on ADLS Gen2 HNS paths, so the driver rejects the call client-side before any REST request.

Source

Thrown at hadoop-tools/hadoop-azure/src/main/java/org/apache/hadoop/fs/azurebfs/services/AbfsBlobClient.java:1457

        "SetPermission operation is only supported on HNS enabled Accounts.");
  }

  /**
   * Set the ACL of the file or directory.
   * Not supported for HNS-Disabled Accounts.
   * @param path on which ACL has to be set.
   * @param aclSpecString to be set.
   * @param eTag to specify conditional headers. Set only if etag matches.
   * @param tracingContext for tracing the server calls.
   * @return exception as this operation is not supported on Blob Endpoint.
   * @throws UnsupportedOperationException always.
   */
  @Override
  public AbfsRestOperation setAcl(final String path,
      final String aclSpecString,
      final String eTag,
      final TracingContext tracingContext) throws AzureBlobFileSystemException {
    throw new UnsupportedOperationException(
        "SetAcl operation is only supported on HNS enabled Accounts.");
  }

  /**
   * Get the ACL of the file or directory.
   * Not supported for HNS-Disabled Accounts.
   * @param path of which properties have to be fetched.
   * @param useUPN whether to use UPN with rest operation.
   * @param tracingContext for tracing the server calls.
   * @return exception as this operation is not supported on Blob Endpoint.
   * @throws UnsupportedOperationException always.
   */
  @Override
  public AbfsRestOperation getAclStatus(final String path,
      final boolean useUPN,
      TracingContext tracingContext) throws AzureBlobFileSystemException {
    throw new UnsupportedOperationException(
        "GetAclStatus operation is only supported on HNS enabled Accounts.");

View on GitHub (pinned to 2add963021)

Solutions

Enable Hierarchical Namespace on the account or use an HNS account for ACL-managed data
Skip ACL application for non-HNS filesystems in your tooling (feature-detect first)
Use Azure RBAC / container-level access policies for access control on flat-namespace accounts

Example fix

// before
fs.setAcl(path, entries);

// after
if (isHnsAccount(fs)) {
  fs.setAcl(path, entries);
}

Defensive patterns

Strategy: validation

Validate before calling

if (isHnsAccount(fs)) {
  fs.setAcl(path, entries);
}

Type guard

private static boolean supportsAcls(FileSystem fs) {
  return !(fs instanceof AzureBlobFileSystem)
      || fs.getConf().getBoolean("fs.azure.account.hns.enabled", false);
}

Try / catch

try {
  fs.setAcl(path, entries);
} catch (UnsupportedOperationException e) {
  // ACLs require HNS: apply Azure-level access policy instead
}

Prevention

Feature-detect HNS before running ACL management jobs
Keep ACL sync tooling scoped to HNS mounts
Do not port HDFS ACL hardening scripts verbatim to blob endpoints

When it happens

Trigger: Calling fs.setAcl(path, entries) against an abfs:// filesystem whose underlying storage account has hierarchical namespace disabled — e.g. ACL migration scripts, Ranger-driven ACL enforcement, distcp preserving ACLs.

Common situations: ACL sync tooling built for HDFS pointed at non-HNS ADLS; security-hardening playbooks that blanket-apply ACLs across all mounted filesystems; accounts onboarded before HNS was enabled.

Related errors

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/9463c6949fcabb98. Report an issue: GitHub.