apache/pulsar · error · RestException

Don't have permission to administrate resources on this tena

Error message

Don't have permission to administrate resources on this tenant

What it means

This is the standard Pulsar admin authorization failure: the authenticated role is neither a super user nor has the tenant admin permission for the requested tenant. validateAdminAccessForTenantAsync throws 401 UNAUTHORIZED whenever the authorization service's isTenantAdmin/isSuperUser checks both come back false for the requesting role.

Source

Thrown at pulsar-broker/src/main/java/org/apache/pulsar/broker/web/PulsarWebResource.java:393

                                                    .log("Successfully authorized on tenant");
                                                                                return CompletableFuture
                                                                                        .completedFuture(null);
                                    }
                                });
                        } else {
                            return pulsar.getBrokerService()
                                    .getAuthorizationService()
                                    .isSuperUser(clientAppId, authenticationData)
                                    .thenCompose(isSuperUser -> {
                                        if (!isSuperUser) {
                                            return pulsar.getBrokerService().getAuthorizationService()
                                                    .isTenantAdmin(tenant, clientAppId, tenantInfo, authenticationData);
                                        } else {
                                            return CompletableFuture.completedFuture(true);
                                        }
                                    }).thenAccept(authorized -> {
                                        if (!authorized) {
                                            throw new RestException(Status.UNAUTHORIZED,
                                                    "Don't have permission to administrate resources on this tenant");
                                        } else {
                                            log.debug()
                                                    .attr("authorized", clientAppId)
                                                    .attr("tenant", tenant)
                                                    .log("Successfully authorized on tenant");
                                        }
                                    });
                        }
                    } else {
                        return CompletableFuture.completedFuture(null);
                    }
                });
    }

    /**
     * It validates that peer-clusters can't coexist in replication-clusters.
     *

View on GitHub (pinned to 820761864e)

Solutions

  1. Add your role to the tenant's adminRoles: pulsar-admin tenants update <tenant> --admin-roles <role1,role2>
  2. Add the role to superUserRoles in broker.conf if it should have full admin
  3. Verify the authenticated role name (check broker logs 'check admin access on tenant' role attr) matches what is in adminRoles
  4. Temporarily test with a superuser token to confirm it is purely an authorization listing issue

Example fix

// before
pulsar-admin tenants create my-tenant --admin-roles team-a
// after (grant team-b too)
pulsar-admin tenants update my-tenant --admin-roles team-a,team-b
Defensive patterns

Strategy: try-catch

Validate before calling

// Check your role is in the tenant's adminRoles before admin calls
TenantInfo t = admin.tenants().getTenant("my-tenant");
if (!t.getAdminRoles().contains(myRole) && !superUserRoles.contains(myRole)) {
    requestAccess("my-tenant", myRole);
}

Try / catch

try {
    admin.tenants().getTenant(tenant);
} catch (PulsarAdminException.NotAuthorizedException e) {
    // 401: role lacks tenant admin — request adminRoles membership or use a superuser client
    log.error("Role {} lacks admin on tenant {}", role, tenant, e);
}

Prevention

When it happens

Trigger: Any admin REST call routed through validateAdminAccessForTenant (tenant create/update/delete, namespace/topic admin ops under a tenant) where the client's role is absent from tenantInfo.adminRoles and not in superUserRoles, with authenticationEnabled=true and authorizationEnabled=true.

Common situations: Client authenticated with a token for a role not listed in the tenant's adminRoles; tenant created by another team so your role was never added; JWT subject differs from the role name configured in adminRoles (prefix/claim mismatch); after enabling authorization on a previously open cluster.

Related errors

AI-assisted analysis of apache/pulsar@820761864e (2026-09-06). Data as JSON: /api/errors/1101d5b3c3d2bf6b. Report an issue: GitHub.