apache/hadoop · error · AccessControlException

"User " + pc.getUser() + " does not belong to " + group

Error message

"User " + pc.getUser() + " does not belong to " + group

What it means

A non-superuser owner may change a file's group only to a group they belong to; when the requested group is not in the caller's group set and the superuser check fails, setOwner throws AccessControlException 'User X does not belong to Y'. Group membership is resolved by the NameNode's group mapping service (LDAP/AD/static), not the client.

Source

Thrown at hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/FSDirAttrOp.java:101

      iip = fsd.resolvePath(pc, src, DirOp.WRITE);
      fsd.checkOwner(pc, iip);
      // At this point, the user must be either owner or super user.
      // superuser: can change owner to a different user,
      // change owner group to any group
      // owner: can't change owner to a different user but can change owner
      // group to different group that the user belongs to.
      if ((username != null && !pc.getUser().equals(username)) ||
          (group != null && !pc.isMemberOfGroup(group))) {
        try {
          // check if the user is superuser
          pc.checkSuperuserPrivilege(iip.getPath());
        } catch (AccessControlException e) {
          if (username != null && !pc.getUser().equals(username)) {
            throw new AccessControlException("User " + pc.getUser()
                + " is not a super user (non-super user cannot change owner).");
          }
          if (group != null && !pc.isMemberOfGroup(group)) {
            throw new AccessControlException(
                "User " + pc.getUser() + " does not belong to " + group);
          }
        }
      }
      changed = unprotectedSetOwner(fsd, iip, username, group);
    } finally {
      fsd.writeUnlock();
    }
    if (changed) {
      fsd.getEditLog().logSetOwner(iip.getPath(), username, group);
    }
    return fsd.getAuditFileInfo(iip);
  }

  static FileStatus setTimes(
      FSDirectory fsd, FSPermissionChecker pc, String src, long mtime,
      long atime) throws IOException {
    INodesInPath iip;

View on GitHub (pinned to 2add963021)

Solutions

1. Have the superuser (or a member of the target group) perform the chgrp.
2. Fix membership at the source (LDAP/AD) and refresh the NameNode's view: 'hdfs dfsadmin -refreshUserToGroupsMappings' plus the dfs.namenode.groups.cache.secs timeout.
3. Verify what the cluster thinks the caller's groups are with 'hdfs groups <user>' and use exactly one of those names.

Example fix

// before
fs.setOwner(path, null, "analytics"); // may throw if user not in group

// after: check membership first
UserGroupInformation ugi = UserGroupInformation.getCurrentUser();
if (!Arrays.asList(ugi.getGroupNames()).contains("analytics")) {
  throw new AccessControlException(ugi.getUserName() + " not in analytics; ask admin or refresh groups");
}
fs.setOwner(path, null, "analytics");

UserGroupInformation ugi = UserGroupInformation.getCurrentUser();
if (group != null && !Arrays.asList(ugi.getGroupNames()).contains(group)) {
  throw new AccessControlException(ugi.getUserName()
      + " is not a member of " + group + "; run as superuser or fix group mapping");
}
fs.setOwner(path, null, group);

try {
  fs.setOwner(path, null, group);
} catch (AccessControlException e) {
  if (e.getMessage().contains("does not belong to")) {
    // verify with 'hdfs groups <user>'; ask superuser to chgrp or refresh group mapping
  }
}

When it happens

Trigger: DistributedFileSystem.setOwner(path, null, group) or 'hdfs dfs -chgrp <group> <path>' by the file owner where the group is absent from their group list as computed by the NN-side group mapping.

Common situations: Users expecting membership in newly created project groups before LDAP/AD provisioning propagates; stale NameNode group-mapping cache; AD environments where group names differ by case or domain prefix from what users pass.

Related errors

• "User " + pc.getUser() + " is not a super user (non-super us
• "Access denied for user " + pc.getUser() + ". Superuser or o
• Disallowed RPC access from {} at {}. Not listed in dfs.clust
• Permission denied: user=%s, path="%s":%s:%s:%s%s
• {} doesn't support modifyAclEntries

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/b265686c4cf8e2cf. Report an issue: GitHub.