apache/hadoop · error · AuthorizationException

User [%s] is not authorized to create key !!

Error message

User [%s] is not authorized to create key !!

What it means

KeyAuthorizationKeyProvider wraps the backing KeyProvider and enforces per-key ACLs. Before creating a key it resolves the key's ACL name (the key.acl.name attribute, defaulting to the key name) and requires the caller to pass hadoop.kms.acl-style key ACLs for MANAGEMENT or ALL on that ACL name (key.acl.<aclname>.MANAGEMENT / .ALL in kms-acls.xml, or the whitelist key.acl entries). On failure it throws AuthorizationException 'User [<name>] is not authorized to create key !!', surfaced as HTTP 403.

Source

Thrown at hadoop-common-project/hadoop-kms/src/main/java/org/apache/hadoop/crypto/key/kms/server/KeyAuthorizationKeyProvider.java:135

    String aclName = attributes.get(KEY_ACL_NAME);
    boolean success = false;
    if (Strings.isNullOrEmpty(aclName)) {
      if (acls.isACLPresent(keyName, KeyOpType.MANAGEMENT)) {
        options.setAttributes(ImmutableMap.<String, String> builder()
            .putAll(attributes).put(KEY_ACL_NAME, keyName).build());
        success =
            acls.hasAccessToKey(keyName, ugi, KeyOpType.MANAGEMENT)
                || acls.hasAccessToKey(keyName, ugi, KeyOpType.ALL);
      } else {
        success = false;
      }
    } else {
      success = acls.isACLPresent(aclName, KeyOpType.MANAGEMENT) &&
          (acls.hasAccessToKey(aclName, ugi, KeyOpType.MANAGEMENT)
          || acls.hasAccessToKey(aclName, ugi, KeyOpType.ALL));
    }
    if (!success)
      throw new AuthorizationException(String.format("User [%s] is not"
          + " authorized to create key !!", ugi.getShortUserName()));
  }

  private void checkAccess(String aclName, UserGroupInformation ugi,
      KeyOpType opType) throws AuthorizationException {
    Preconditions.checkNotNull(aclName, "Key ACL name cannot be null");
    Preconditions.checkNotNull(ugi, "UserGroupInformation cannot be null");
    if (acls.isACLPresent(aclName, opType) &&
        (acls.hasAccessToKey(aclName, ugi, opType)
            || acls.hasAccessToKey(aclName, ugi, KeyOpType.ALL))) {
      return;
    } else {
      throw new AuthorizationException(String.format("User [%s] is not"
          + " authorized to perform [%s] on key with ACL name [%s]!!",
          ugi.getShortUserName(), opType, aclName));
    }
  }

View on GitHub (pinned to 2add963021)

Solutions

1. Add an entry to kms-acls.xml: key.acl.<aclname>.MANAGEMENT (or key.acl.<aclname>.ALL) containing the creating user/group
2. Ensure the ACL name matches what the client sends in the key.acl.name attribute (defaults to the key name)
3. Rely on the hot reload of kms-acls.xml or restart KMS, then retry the create
4. Give the creator the broader .ALL key ACL if that user should manage all operations on the key

Example fix

<!-- kms-acls.xml -->
<property>
  <name>key.acl.mykey.MANAGEMENT</name>
  <value>hdfs,kmadmin</value>
</property>

try { provider.createKey(name, options); } catch (AuthorizationException e) { // 403: user not in key.acl.<name>.MANAGEMENT/ALL — provision the ACL, do not retry }

When it happens

Trigger: POST /v1/key (or KeyProvider.createKey) where kms-acls.xml has no key.acl.<aclname>.MANAGEMENT (nor .ALL) entry for the key's ACL name, or the user is absent from it; also when the KMS ACL CREATE check passed but the per-key MANAGEMENT check did not — key-level ACLs are stricter than the server-level ones.

Common situations: Creating keys without provisioning key.acl.<name>.MANAGEMENT entries first; teams expecting server-wide hadoop.kms.acl.CREATE to be sufficient; ACL-name mismatch between the key.acl.name attribute supplied at creation and the entry configured in kms-acls.xml.

Related errors

• User [%s] is not authorized to perform [%s] on key with ACL
• User:%s not allowed to do '%s' on '%s'
• hadoop.security.authorizationis configured to true but servi
• FATAL_UNAUTHORIZED
• Null protocol not authorized

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/747878e08fff1a60. Report an issue: GitHub.