{"record":{"id":"017fe9fb5e1d4749","repo":"prestodb/presto","slug":"access-denied","errorCode":"ACCESS_DENIED","errorMessage":"Query integrity check failed.","messagePattern":"Query integrity check failed\\.","errorType":"exception","errorClass":"AccessDeniedException","httpStatus":403,"severity":"error","filePath":"presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java","lineNumber":42,"sourceCode":"import static com.facebook.presto.spi.StandardErrorCode.PERMISSION_DENIED;\nimport static java.lang.String.format;\n\npublic class AccessDeniedException\n        extends PrestoException\n{\n    public AccessDeniedException(String message)\n    {\n        super(PERMISSION_DENIED, \"Access Denied: \" + message);\n    }\n\n    public static void denySetUser(Optional<Principal> principal, String userName)\n    {\n        denySetUser(principal, userName, null);\n    }\n\n    public static void denyQueryIntegrityCheck()\n    {\n        throw new AccessDeniedException(\"Query integrity check failed.\");\n    }\n\n    public static void denySetUser(Optional<Principal> principal, String userName, String extraInfo)\n    {\n        throw new AccessDeniedException(format(\"Principal %s cannot become user %s%s\", principal.orElse(null), userName, formatExtraInfo(extraInfo)));\n    }\n\n    public static void denyCatalogAccess(String catalogName)\n    {\n        denyCatalogAccess(catalogName, null);\n    }\n\n    public static void denyCatalogAccess(String catalogName, String extraInfo)\n    {\n        throw new AccessDeniedException(format(\"Cannot access catalog %s%s\", catalogName, formatExtraInfo(extraInfo)));\n    }\n\n    public static void denyCreateSchema(String schemaName)","sourceCodeStart":24,"sourceCodeEnd":60,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java#L24-L60","documentation":"AccessDeniedException.denyQueryIntegrityCheck is a helper used by system access control implementations to reject query-integrity verification requests. Systems access controls call this when the configured authorizer does not support or refuses to attest to query integrity checks (e.g. can't guarantee the query hasn't been tampered with between validation and execution).","triggerScenarios":"A SystemAccessControl implementation calls denyQueryIntegrityCheck() because checkQueryIntegrity / integrity attestation is not supported by the configured security policy.","commonSituations":"Clusters configured with a custom or legacy access control plugin lacking integrity-check support; enabling features that require query integrity verification while using a basic file-based or read-only authorizer; security policy upgrades introducing integrity requirements the plugin predates.","solutions":["Implement/upgrade the SystemAccessControl plugin to support query integrity checks","Switch to an access control implementation that supports integrity verification","Disable the feature that requires integrity checks if your security model permits it","Check the access control plugin version against the engine version's requirements"],"exampleFix":"// before\n@Override\npublic void checkQueryIntegrity(...) {\n    denyQueryIntegrityCheck();\n}\n// after\n@Override\npublic void checkQueryIntegrity(...) {\n    if (!supportsIntegrityChecks) {\n        denyQueryIntegrityCheck(); // make this opt-in/configurable\n    }\n    verifyQueryHash(...);\n}","handlingStrategy":"validation","validationCode":"// Before enabling integrity-dependent features, confirm the authorizer supports it\nboolean supported = systemAccessControl instanceof QueryIntegrityCapable;\nif (!supported) {\n    LOG.warn(\"Configured access control does not support query integrity checks\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    query.submit();\n} catch (AccessDeniedException e) {\n    if (e.getMessage().contains(\"Query integrity check failed\")) {\n        // upgrade/replace the SystemAccessControl plugin or disable the integrity-gated feature\n    }\n    throw e;\n}","preventionTips":["Match the access control plugin version to engine requirements before upgrading","Verify integrity-check support before enabling features that require it","Keep custom SystemAccessControl implementations updated with new SPI methods"],"tags":["security","access-denied","authorization"],"backgroundTag":"access-denied","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}