apache/hadoop · error · AccessControlException

User {} doesn't have permission to call '{}'

Error message

User {} doesn't have permission to call '{}'

What it means

HSAdminServer checks every admin RPC against the admin ACL built from mapreduce.jobhistory.admin.acl (JHAdminConfig.MR_HISTORY_ADMIN_ACL, default '*'). Authentication and proxy rules are applied first; if the authenticated user is not allowed by the ACL, an AccessControlException with this message is thrown, a LOG.warn is emitted, and an HSAuditLogger failure record is written. The exception is by design an authorization denial, not a malfunction.

Source

Thrown at hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-hs/src/main/java/org/apache/hadoop/mapreduce/v2/hs/server/HSAdminServer.java:183

      user = UserGroupInformation.getCurrentUser();
    } catch (IOException ioe) {
      LOG.warn("Couldn't get current user", ioe);

      HSAuditLogger.logFailure("UNKNOWN", method, adminAcl.toString(),
          HISTORY_ADMIN_SERVER, "Couldn't get current user");

      throw ioe;
    }

    if (!adminAcl.isUserAllowed(user)) {
      LOG.warn("User " + user.getShortUserName() + " doesn't have permission"
          + " to call '" + method + "'");

      HSAuditLogger.logFailure(user.getShortUserName(), method,
          adminAcl.toString(), HISTORY_ADMIN_SERVER,
          AuditConstants.UNAUTHORIZED_USER);

      throw new AccessControlException("User " + user.getShortUserName()
          + " doesn't have permission" + " to call '" + method + "'");
    }
    LOG.info("HS Admin: " + method + " invoked by user "
        + user.getShortUserName());

    return user;
  }

  @Override
  public String[] getGroupsForUser(String user) throws IOException {
    return UserGroupInformation.createRemoteUser(user).getGroupNames();
  }

  @Override
  public void refreshUserToGroupsMappings() throws IOException {

    UserGroupInformation user = checkAcls("refreshUserToGroupsMappings");

View on GitHub (pinned to 2add963021)

Solutions

1. Add the calling user (or their group) to mapreduce.jobhistory.admin.acl in mapred-site.xml and restart JHS.
2. Verify group resolution for the user if the ACL uses groups (getGroupsForUser).
3. Run the admin operation as an already-allowed user such as the mapred service account.
4. Check the HSAuditLogger failure entry to confirm which user and method were denied.

Example fix

<!-- before: only mapred may call admin ops -->
<property>
  <name>mapreduce.jobhistory.admin.acl</name>
  <value>mapred</value>
</property>

<!-- after: grant the operator user -->
<property>
  <name>mapreduce.jobhistory.admin.acl</name>
  <value>mapred opsalice</value>
</property>

try {
  hsAdminClient.someAdminMethod(args);
} catch (org.apache.hadoop.security.AccessControlException e) {
  // expected for non-admin users: report which user/method, do not retry unchanged
  throw new IllegalStateException("not in mapreduce.jobhistory.admin.acl: " + e.getMessage(), e);
}

When it happens

Trigger: Invoking HSAdminServer admin operations as a user or group not listed in mapreduce.jobhistory.admin.acl; the ACL restricted to specific users after hardening; group membership not resolving for a group-based ACL entry.

Common situations: Operators tightening the admin ACL post-deployment; tooling using a service account never added to the ACL; LDAP/group resolution failures making group entries ineffective.

Related errors

• User {} cannot perform operation {} on {}
• Access denied: User {} does not have permission to view job
• Null protocol not authorized
• User {} can not be added
• Group {} can not be added

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/189fb644f660a5d8. Report an issue: GitHub.