{"record":{"id":"136ec754f799e3fa","repo":"apache/dolphinscheduler","slug":"user-no-operation-perm-136ec7","errorCode":"USER_NO_OPERATION_PERM","errorMessage":"USER_NO_OPERATION_PERM: user has no operation permission","messagePattern":"USER_NO_OPERATION_PERM: user has no operation permission","errorType":"error_code","errorClass":"ServiceException","httpStatus":null,"severity":"error","filePath":"dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/QueueServiceImpl.java","lineNumber":166,"sourceCode":"        IPage<Queue> queueList = queueDao.queryQueuePaging(page, new ArrayList<>(ids), searchVal);\n        Integer count = (int) queueList.getTotal();\n        pageInfo.setTotal(count);\n        pageInfo.setTotalList(queueList.getRecords());\n        return pageInfo;\n    }\n\n    /**\n     * create queue\n     *\n     * @param loginUser login user\n     * @param queue     queue\n     * @param queueName queue name\n     * @return create result\n     */\n    @Override\n    public Queue createQueue(User loginUser, String queue, String queueName) {\n        if (!canOperatorPermissions(loginUser, null, AuthorizationType.QUEUE, YARN_QUEUE_CREATE)) {\n            throw new ServiceException(Status.USER_NO_OPERATION_PERM);\n        }\n\n        Queue queueObj = new Queue(queueName, queue);\n        validQueue(queueObj);\n        queueDao.insert(queueObj);\n\n        return queueObj;\n    }\n\n    /**\n     * update queue\n     *\n     * @param loginUser login user\n     * @param queue     queue\n     * @param id        queue id\n     * @param queueName queue name\n     * @return update result code\n     */","sourceCodeStart":148,"sourceCodeEnd":184,"githubUrl":"https://github.com/apache/dolphinscheduler/blob/02eac45a1b6676e639fcbfb4be2243de5771b05d/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/QueueServiceImpl.java#L148-L184","documentation":"USER_NO_OPERATION_PERM is thrown in createQueue when canOperatorPermissions(loginUser, null, AuthorizationType.QUEUE, YARN_QUEUE_CREATE) returns false, i.e. the logged-in user lacks the permission bit needed to manage YARN queues. The service refuses the operation before any validation or insert.","triggerScenarios":"A non-admin user calling the queue-create REST endpoint; a service account whose role was downgraded; API tokens issued for a user without QUEUE authorization type permissions.","commonSituations":"Calling admin-only queue management APIs from tenant-level automation; role changes after reorganizing DolphinScheduler permission groups; using the wrong user's session/token in CI scripts.","solutions":["Log in as a user with QUEUE management permission (typically ADMIN)","Grant the user QUEUE authorization via the permission management APIs/UI","Use a dedicated admin service account for queue automation"],"exampleFix":"// before\nqueueService.createQueue(tenantUser, \"default\", \"DefaultQueue\"); // no perm\n// after\nif (canOperatorPermissions(loginUser, null, AuthorizationType.QUEUE, YARN_QUEUE_CREATE)) {\n    queueService.createQueue(loginUser, \"default\", \"DefaultQueue\");\n}","handlingStrategy":"try-catch","validationCode":"boolean allowed = canOperatorPermissions(loginUser, null, AuthorizationType.QUEUE, YARN_QUEUE_CREATE);\nif (!allowed) {\n    throw new IllegalStateException(\"User \" + loginUser.getUserName() + \" lacks QUEUE create permission\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    queueService.createQueue(loginUser, queue, queueName);\n} catch (ServiceException e) {\n    if (e.getCode() == Status.USER_NO_OPERATION_PERM.getCode()) { /* escalate role or use admin account */ }\n    throw e;\n}","preventionTips":["Use an admin or properly authorized service account for queue management","Check the user's AuthorizationType.QUEUE permissions before automation runs","Keep API tokens tied to users with the required role","Verify role assignments after permission reorganizations"],"tags":["permission","authorization","queue"],"backgroundTag":"permission-denied","analyzedSha":"02eac45a1b6676e639fcbfb4be2243de5771b05d","analyzedAt":"2026-09-06T17:43:00.555Z","contentChangedAt":"2026-09-06T17:43:00.555Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}