What causes "User not in HttpFSServer admin group" in apache/hadoop?

Add the requesting user to the group named by httpfs.admin.group (default: hadoop): usermod -aG hadoop bob, then log in again (groups are resolved at request time — also mind the group-mapping cache).

apache/hadoop · error · AccessControlException

User not in HttpFSServer admin group

Error message

User not in HttpFSServer admin group

What it means

The INSTRUMENTATION operation exposes HttpFS server metrics and is restricted to members of the admin group (httpfs.admin.group, default 'hadoop'). HttpFSServer resolves the authenticated user's group set via the Groups service; if the admin group is not among them, it throws AccessControlException('User not in HttpFSServer admin group'), which surfaces to the client as HTTP 403.

Source

Thrown at hadoop-hdfs-project/hadoop-hdfs-httpfs/src/main/java/org/apache/hadoop/fs/http/server/HttpFSServer.java:336

      Map json = fsExecute(user, command);
      AUDIT_LOG.info("[{}] filter [{}]", path, (filter != null) ? filter : "-");
      response = Response.ok(json).type(MediaType.APPLICATION_JSON).build();
      break;
    }
    case GETHOMEDIRECTORY: {
      enforceRootPath(op.value(), path);
      FSOperations.FSHomeDir command = new FSOperations.FSHomeDir();
      JSONObject json = fsExecute(user, command);
      AUDIT_LOG.info("Home Directory for [{}]", user);
      response = Response.ok(json).type(MediaType.APPLICATION_JSON).build();
      break;
    }
    case INSTRUMENTATION: {
      enforceRootPath(op.value(), path);
      Groups groups = HttpFSServerWebApp.get().get(Groups.class);
      Set<String> userGroups = groups.getGroupsSet(user.getShortUserName());
      if (!userGroups.contains(HttpFSServerWebApp.get().getAdminGroup())) {
        throw new AccessControlException(
            "User not in HttpFSServer admin group");
      }
      Instrumentation instrumentation =
          HttpFSServerWebApp.get().get(Instrumentation.class);
      Map snapshot = instrumentation.getSnapshot();
      response = Response.ok(snapshot).build();
      break;
    }
    case GETCONTENTSUMMARY: {
      FSOperations.FSContentSummary command =
          new FSOperations.FSContentSummary(path);
      Map json = fsExecute(user, command);
      AUDIT_LOG.info("Content summary for [{}]", path);
      response = Response.ok(json).type(MediaType.APPLICATION_JSON).build();
      break;
    }
    case GETQUOTAUSAGE: {
      FSOperations.FSQuotaUsage command =

View on GitHub (pinned to 2add963021)

Solutions

Add the requesting user to the group named by httpfs.admin.group (default: hadoop): usermod -aG hadoop bob, then log in again (groups are resolved at request time — also mind the group-mapping cache).
If the org's admin group differs, set httpfs.admin.group in httpfs-site.xml to the real group name and restart HttpFS.
Verify resolution with `id bob` on the HttpFS host and with the hadoop group-mapping used by the server.

Example fix

<!-- before: httpfs-site.xml -->
<property><name>httpfs.admin.group</name><value>hadoop</value></property>

<!-- after -->
<property><name>httpfs.admin.group</name><value>httpfs-admins</value></property>

# then ensure the polling user is in that group and restart httpfs

Defensive patterns

Strategy: try-catch

Validate before calling

// client: verify group membership before calling (best effort)
UserGroupInformation ugi = UserGroupInformation.getLoginUser();
String adminGroup = conf.get("httpfs.admin.group", "hadoop");
if (!ugi.getGroupSets().stream().flatMap(Collection::stream).anyMatch(adminGroup::equals)) {
  LOG.warn("{} lacks admin group {}; INSTRUMENTATION will 403", ugi, adminGroup);
}

Try / catch

try {
  metrics = client.get(url + "/webhdfs/v1/?op=INSTRUMENTATION");
} catch (HttpResponseException e) {
  if (e.getStatusCode() == 403) {
    // not in httpfs.admin.group: grant group or change httpfs.admin.group
    LOG.warn("access denied for instrumentation: {}", e.getMessage());
  } else throw e;
}

Prevention

Poll metrics with a dedicated service account placed in the admin group.
Set httpfs.admin.group explicitly to an existing group instead of relying on the 'hadoop' default.
Remember group-mapping caches: re-login or wait after group changes.

When it happens

Trigger: GET /webhdfs/v1/?op=INSTRUMENTATION&user.name=bob where bob is not in the configured admin group; admin group configured to a group that does not exist in the name service (so nobody resolves into it); stale group mapping cache after the user was just added to the group.

Common situations: Monitoring systems polling HttpFS metrics with a service account that was never granted admin; defaulting to httpfs.admin.group=hadoop when the org uses a different admin group; group-provider (LDAP) outage making group resolution incomplete.

Related errors

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/42e53d5f9ceaecf2. Report an issue: GitHub.