apache/hadoop · error · AccessControlException

The authorization provider does not implement the checkPermi

Error message

The authorization provider does not implement the checkPermissionWithContext(AuthorizationContext) API.

What it means

INodeAttributeProvider.AccessControlEnforcer.checkPermissionWithContext(AuthorizationContext) is a Java default method whose only behavior is to throw AccessControlException. If the authorization provider configured via dfs.namenode.inode.attributes.provider.class does not override this newer context-based API, every code path that calls it (notably HDFS Router-based federation permission checks and newer NameNode internals) fails with this error even though the legacy checkPermission methods work.

Source

Thrown at hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/INodeAttributeProvider.java:404

    public abstract void checkPermission(String fsOwner, String supergroup,
        UserGroupInformation callerUgi, INodeAttributes[] inodeAttrs,
        INode[] inodes, byte[][] pathByNameArr, int snapshotId, String path,
        int ancestorIndex, boolean doCheckOwner, FsAction ancestorAccess,
        FsAction parentAccess, FsAction access, FsAction subAccess,
        boolean ignoreEmptyDir)
            throws AccessControlException;

    /**
     * Checks permission on a file system object. Has to throw an Exception
     * if the filesystem object is not accessible by the calling Ugi.
     * @param authzContext an {@link AuthorizationContext} object encapsulating
     *                     the various parameters required to authorize an
     *                     operation.
     * @throws AccessControlException
     */
    default void checkPermissionWithContext(AuthorizationContext authzContext)
        throws AccessControlException {
      throw new AccessControlException("The authorization provider does not "
          + "implement the checkPermissionWithContext(AuthorizationContext) "
          + "API.");
    }

    /**
     * Checks if the user is a superuser or belongs to superuser group.
     * It throws an AccessControlException if user is not a superuser.
     *
     * @param authzContext an {@link AuthorizationContext} object encapsulating
     *                     the various parameters required to authorize an
     *                     operation.
     * @throws AccessControlException - if user is not a super user or part
     * of the super user group.
     */
    default void checkSuperUserPermissionWithContext(
        AuthorizationContext authzContext)
        throws AccessControlException {
      UserGroupInformation callerUgi = authzContext.getCallerUgi();

View on GitHub (pinned to 2add963021)

Solutions

1. Override checkPermissionWithContext(AuthorizationContext) in the custom AccessControlEnforcer — usually by unpacking the context and delegating to the existing permission logic — then redeploy the provider jar
2. Upgrade the provider to a release built against the running Hadoop version
3. If the provider is unnecessary, remove dfs.namenode.inode.attributes.provider.class from the NameNode/Router config

Example fix

// before: only legacy API implemented -> default method throws
class MyEnforcer extends INodeAttributeProvider.AccessControlEnforcer {
  @Override public void checkPermission(String caller, String inode, ...
      throws AccessControlException) { /* legacy logic */ }
}

// after: bridge the context API to existing logic
class MyEnforcer extends INodeAttributeProvider.AccessControlEnforcer {
  @Override public void checkPermissionWithContext(AuthorizationContext ctx)
      throws AccessControlException {
    checkPermission(ctx.getCallerUgi().getShortUserName(),
        ctx.getInodePath(), ctx.getInodeAttrs(), ctx.getAction());
  }
}

// Deploy-time check: does the configured enforcer actually override the context API?
Method m = enforcer.getClass().getMethod(
    "checkPermissionWithContext", AuthorizationContext.class);
if (m.getDeclaringClass()
    .equals(INodeAttributeProvider.AccessControlEnforcer.class)) {
  throw new RuntimeException(enforcer.getClass().getName()
      + " does not implement checkPermissionWithContext(AuthorizationContext)");
}

boolean supportsContextApi(INodeAttributeProvider.AccessControlEnforcer e) {
  try {
    Method m = e.getClass().getMethod(
        "checkPermissionWithContext", AuthorizationContext.class);
    return !m.getDeclaringClass()
        .equals(INodeAttributeProvider.AccessControlEnforcer.class);
  } catch (NoSuchMethodException ex) {
    return false;
  }
}

catch (AccessControlException e) {
  if (e.getMessage() != null && e.getMessage().contains(
      "checkPermissionWithContext")) {
    // provider/API mismatch: fix the deployment, do not retry
    throw new IllegalStateException("Authorization provider incompatible "
        + "with running Hadoop version; implement/upgrade the provider", e);
  }
  throw e;
}

When it happens

Trigger: A custom INodeAttributeProvider (Ranger/Sentry-style plugin or in-house enforcer) implements only the legacy checkPermission(String, String, INodeAttributes, ...) and a Router or upgraded NameNode invokes checkPermissionWithContext; deploying a provider jar compiled against an older hadoop-hdfs than the running cluster.

Common situations: Upgrading Hadoop (or adding HDFS Router federation) while keeping a third-party authz plugin built for the old API surface; integrating an internal authorization service that was written before the AuthorizationContext API existed.

Related errors

• Access denied for user {}. Superuser privilege is required f
• Permission denied: user=%s, path="%s":%s:%s:%s%s
• Interrupted waiting for doPreUpgrade() response
• Timed out waiting for doPreUpgrade() response
• Interrupted waiting for doUpgrade() response

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/47ed48e8830231c2. Report an issue: GitHub.