{"record":{"id":"06eec51ef8fe406a","repo":"apache/pulsar","slug":"this-operation-requires-super-user-access-06eec5","errorCode":null,"errorMessage":"This operation requires super-user access","messagePattern":"This operation requires super-user access","errorType":"http","errorClass":"RestException","httpStatus":401,"severity":"error","filePath":"pulsar-functions/worker/src/main/java/org/apache/pulsar/functions/worker/rest/api/ComponentImpl.java","lineNumber":1087,"sourceCode":"\n    @Override\n    public List<ConnectorDefinition> getListOfConnectors() {\n        if (!isWorkerServiceAvailable()) {\n            throwUnavailableException();\n        }\n\n        return this.worker().getConnectorsManager().getConnectorDefinitions();\n    }\n\n    @Override\n    public void reloadConnectors(AuthenticationParameters authParams) {\n        if (!isWorkerServiceAvailable()) {\n            throwUnavailableException();\n        }\n        if (worker().getWorkerConfig().isAuthorizationEnabled()) {\n            // Only superuser has permission to do this operation.\n            if (!isSuperUser(authParams)) {\n                throw new RestException(Status.UNAUTHORIZED, \"This operation requires super-user access\");\n            }\n        }\n        try {\n            this.worker().getConnectorsManager().reloadConnectors(worker().getWorkerConfig());\n        } catch (IOException e) {\n            throw new RestException(Status.INTERNAL_SERVER_ERROR, e.getMessage());\n        }\n    }\n\n    @Override\n    public String triggerFunction(final String tenant,\n                                  final String namespace,\n                                  final String functionName,\n                                  final String input,\n                                  final InputStream uploadedInputStream,\n                                  final String topic,\n                                  final AuthenticationParameters authParams) {\n","sourceCodeStart":1069,"sourceCodeEnd":1105,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-functions/worker/src/main/java/org/apache/pulsar/functions/worker/rest/api/ComponentImpl.java#L1069-L1105","documentation":"reloadConnectors requires super-user privileges when authorization is enabled on the function worker. If the authenticated principal is not in the super-user roles list, the worker returns HTTP 401 Unauthorized with this message and does not reload connectors.","triggerScenarios":"POST /admin/v3/functions/connectors/reload (reloadConnectors) called with credentials whose role is not listed in workerConfig's superUserRoles while authorizationEnabled=true.","commonSituations":"Ops automation running with a regular admin/service account instead of a super-user role; superUserRoles misconfigured on the worker after a config change; missing/invalid auth token so the role resolves to an anonymous non-super-user.","solutions":["Add the caller's role to superUserRoles in the worker config (workerConfig) and restart/reload the worker.","Re-authenticate with credentials for an existing super-user role (valid client token/certificate).","If authorization is intentionally disabled in your environment, confirm isAuthorizationEnabled=false so the check is skipped.","Verify which role the worker resolved by checking its auth logs before adjusting configs."],"exampleFix":"// worker.conf before\nauthorizationEnabled=true\nsuperUserRoles=admin-readonly\n// after\nauthorizationEnabled=true\nsuperUserRoles=admin-readonly,connector-ops","handlingStrategy":"try-catch","validationCode":"// Pre-check that the credential's role is a configured super-user\nboolean isSuperUser = workerConf.getSuperUserRoles().contains(myRole) && workerConf.isAuthorizationEnabled() == false ||\n                      workerConf.getSuperUserRoles().contains(myRole);","typeGuard":null,"tryCatchPattern":"try { admin.connectors().reloadConnectors(); }\ncatch (PulsarAdminException e) {\n  if (e.getResponseStatus() == 401)\n    log.error(\"reloadConnectors requires super-user; role={} not in superUserRoles\", myRole);\n  else throw e;\n}","preventionTips":["Run connector reload automation with a dedicated role listed in superUserRoles","Audit superUserRoles after every worker config change","Verify token/cert validity before scheduled reload jobs"],"tags":["authorization","rest-api","pulsar-functions","permissions"],"backgroundTag":"insufficient-permissions","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}