{"record":{"id":"1101d5b3c3d2bf6b","repo":"apache/pulsar","slug":"don-t-have-permission-to-administrate-resources-on","errorCode":null,"errorMessage":"Don't have permission to administrate resources on this tenant","messagePattern":"Don't have permission to administrate resources on this tenant","errorType":"http","errorClass":"RestException","httpStatus":401,"severity":"error","filePath":"pulsar-broker/src/main/java/org/apache/pulsar/broker/web/PulsarWebResource.java","lineNumber":393,"sourceCode":"                                                    .log(\"Successfully authorized on tenant\");\n                                                                                return CompletableFuture\n                                                                                        .completedFuture(null);\n                                    }\n                                });\n                        } else {\n                            return pulsar.getBrokerService()\n                                    .getAuthorizationService()\n                                    .isSuperUser(clientAppId, authenticationData)\n                                    .thenCompose(isSuperUser -> {\n                                        if (!isSuperUser) {\n                                            return pulsar.getBrokerService().getAuthorizationService()\n                                                    .isTenantAdmin(tenant, clientAppId, tenantInfo, authenticationData);\n                                        } else {\n                                            return CompletableFuture.completedFuture(true);\n                                        }\n                                    }).thenAccept(authorized -> {\n                                        if (!authorized) {\n                                            throw new RestException(Status.UNAUTHORIZED,\n                                                    \"Don't have permission to administrate resources on this tenant\");\n                                        } else {\n                                            log.debug()\n                                                    .attr(\"authorized\", clientAppId)\n                                                    .attr(\"tenant\", tenant)\n                                                    .log(\"Successfully authorized on tenant\");\n                                        }\n                                    });\n                        }\n                    } else {\n                        return CompletableFuture.completedFuture(null);\n                    }\n                });\n    }\n\n    /**\n     * It validates that peer-clusters can't coexist in replication-clusters.\n     *","sourceCodeStart":375,"sourceCodeEnd":411,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-broker/src/main/java/org/apache/pulsar/broker/web/PulsarWebResource.java#L375-L411","documentation":"This is the standard Pulsar admin authorization failure: the authenticated role is neither a super user nor has the tenant admin permission for the requested tenant. validateAdminAccessForTenantAsync throws 401 UNAUTHORIZED whenever the authorization service's isTenantAdmin/isSuperUser checks both come back false for the requesting role.","triggerScenarios":"Any admin REST call routed through validateAdminAccessForTenant (tenant create/update/delete, namespace/topic admin ops under a tenant) where the client's role is absent from tenantInfo.adminRoles and not in superUserRoles, with authenticationEnabled=true and authorizationEnabled=true.","commonSituations":"Client authenticated with a token for a role not listed in the tenant's adminRoles; tenant created by another team so your role was never added; JWT subject differs from the role name configured in adminRoles (prefix/claim mismatch); after enabling authorization on a previously open cluster.","solutions":["Add your role to the tenant's adminRoles: pulsar-admin tenants update <tenant> --admin-roles <role1,role2>","Add the role to superUserRoles in broker.conf if it should have full admin","Verify the authenticated role name (check broker logs 'check admin access on tenant' role attr) matches what is in adminRoles","Temporarily test with a superuser token to confirm it is purely an authorization listing issue"],"exampleFix":"// before\npulsar-admin tenants create my-tenant --admin-roles team-a\n// after (grant team-b too)\npulsar-admin tenants update my-tenant --admin-roles team-a,team-b","handlingStrategy":"try-catch","validationCode":"// Check your role is in the tenant's adminRoles before admin calls\nTenantInfo t = admin.tenants().getTenant(\"my-tenant\");\nif (!t.getAdminRoles().contains(myRole) && !superUserRoles.contains(myRole)) {\n    requestAccess(\"my-tenant\", myRole);\n}","typeGuard":null,"tryCatchPattern":"try {\n    admin.tenants().getTenant(tenant);\n} catch (PulsarAdminException.NotAuthorizedException e) {\n    // 401: role lacks tenant admin — request adminRoles membership or use a superuser client\n    log.error(\"Role {} lacks admin on tenant {}\", role, tenant, e);\n}","preventionTips":["Add intended operator roles to tenant adminRoles at tenant creation time","Keep JWT subject/role names aligned with adminRoles entries","Recheck tenant adminRoles after org/team changes"],"tags":["authorization","http-401","tenant","pulsar-admin"],"backgroundTag":"insufficient-admin-permissions","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}