{"record":{"id":"0154246a0762c1d1","repo":"apache/hadoop","slug":"access-denied-for-user-superuser-privilege-is","errorCode":null,"errorMessage":"Access denied for user {}. Superuser privilege is required for operation {}","messagePattern":"Access denied for user (.+?)\\. Superuser privilege is required for operation (.+?)","errorType":"exception","errorClass":"AccessControlException","httpStatus":null,"severity":"error","filePath":"hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/INodeAttributeProvider.java","lineNumber":427,"sourceCode":"    /**\n     * Checks if the user is a superuser or belongs to superuser group.\n     * It throws an AccessControlException if user is not a superuser.\n     *\n     * @param authzContext an {@link AuthorizationContext} object encapsulating\n     *                     the various parameters required to authorize an\n     *                     operation.\n     * @throws AccessControlException - if user is not a super user or part\n     * of the super user group.\n     */\n    default void checkSuperUserPermissionWithContext(\n        AuthorizationContext authzContext)\n        throws AccessControlException {\n      UserGroupInformation callerUgi = authzContext.getCallerUgi();\n      boolean isSuperUser =\n          callerUgi.getShortUserName().equals(authzContext.getFsOwner()) ||\n          callerUgi.getGroupsSet().contains(authzContext.getSupergroup());\n      if (!isSuperUser) {\n        throw new AccessControlException(\"Access denied for user \" +\n            callerUgi.getShortUserName() + \". Superuser privilege is \" +\n            \"required for operation \" + authzContext.getOperationName());\n      }\n    }\n\n    /**\n     * This method must be called when denying access to users to\n     * notify the external enforcers.\n     * This will help the external enforcers to audit the requests\n     * by users that were denied access.\n     * @param authzContext an {@link AuthorizationContext} object encapsulating\n     *                     the various parameters required to authorize an\n     *                     operation.\n     * @throws AccessControlException\n     */\n    default void denyUserAccess(AuthorizationContext authzContext,\n                                String errorMessage)\n        throws AccessControlException {","sourceCodeStart":409,"sourceCodeEnd":445,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/INodeAttributeProvider.java#L409-L445","documentation":"The default INodeAttributeProvider.AccessControlEnforcer.checkSuperUserPermissionWithContext throws AccessControlException when the caller's short username is not the NameNode start user (fsOwner) AND the caller's groups do not contain the supergroup. This default is the superuser gate used (among others) by HDFS Router admin paths when no custom provider overrides it; the message names the denied user and the operation that required privilege.","triggerScenarios":"Invoking an admin operation that routes through checkSuperUserPermissionWithContext (Router-based federation admin APIs, superuser-gated refresh ops) as a user who is neither the NN start user nor in dfs.permissions.supergroup; Kerberos principal mismatch between caller and fsOwner.","commonSituations":"Running admin commands from a service account that was never granted the supergroup; supergroup left at default 'supergroup' with no members added; after changing dfs.permissions.supergroup without restarting or re-issuing group membership.","solutions":["Run the operation as the NameNode start user (typically 'hdfs') via sudo -u hdfs or kinit as the NN principal","Add the caller to the group configured in dfs.permissions.supergroup (verify with `id <user>`) and retry","If a custom authz provider should govern this check, override checkSuperUserPermissionWithContext instead of relying on the default"],"exampleFix":"# before\nkinit opsuser@REALM\nhdfs dfsadmin -refreshNodes   # opsuser is not fsOwner/supergroup -> denied\n\n# after\nsudo -u hdfs hdfs dfsadmin -refreshNodes\n# or: usermod -aG supergroup opsuser && re-login && retry","handlingStrategy":"validation","validationCode":"// Verify superuser privilege before invoking a superuser-gated admin op\nUserGroupInformation ugi = UserGroupInformation.getCurrentUser();\nboolean isSuper = ugi.getShortUserName().equals(fsOwner)\n    || ugi.getGroupsSet().contains(supergroup);   // e.g. from dfs.permissions.supergroup\nif (!isSuper) {\n  throw new AccessControlException(\"Run as \" + fsOwner\n      + \" or a member of \" + supergroup);\n}","typeGuard":null,"tryCatchPattern":"catch (AccessControlException e) {\n  if (e.getMessage() != null && e.getMessage().contains(\"Superuser privilege is required\")) {\n    // privilege problem — escalate/reauthenticate as fsOwner or supergroup member; do not retry as-is\n    throw new SecurityException(\"Re-run as the NameNode user or add caller to \"\n        + \"dfs.permissions.supergroup\", e);\n  }\n  throw e;\n}","preventionTips":["Centralize admin operations in a wrapper that kinit/sudo's as the NameNode start user","Keep an explicit mapping of service accounts to dfs.permissions.supergroup membership","Verify group resolution (id <user>) on the gateway host — NSS/LDAP hiccups silently drop supergroup membership"],"tags":["hdfs","authorization","superuser","permissions","rbf"],"backgroundTag":"authorization-permission-denied","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}