{"record":{"id":"1531b642e1f0c11b","repo":"prestodb/presto","slug":"missing-role-1531b6","errorCode":"MISSING_ROLE","errorMessage":"Role '%s' does not exist","messagePattern":"Role '(.+?)' does not exist","errorType":"error_code","errorClass":"SemanticException","httpStatus":null,"severity":"error","filePath":"presto-main-base/src/main/java/com/facebook/presto/execution/DropRoleTask.java","lineNumber":50,"sourceCode":"\npublic class DropRoleTask\n        implements DDLDefinitionTask<DropRole>\n{\n    @Override\n    public String getName()\n    {\n        return \"DROP ROLE\";\n    }\n\n    @Override\n    public ListenableFuture<?> execute(DropRole statement, TransactionManager transactionManager, Metadata metadata, AccessControl accessControl, Session session, List<Expression> parameters, WarningCollector warningCollector, String query)\n    {\n        String catalog = createCatalogName(session, statement);\n        String role = statement.getName().getValueLowerCase();\n        accessControl.checkCanDropRole(session.getRequiredTransactionId(), session.getIdentity(), session.getAccessControlContext(), role, catalog);\n        Set<String> existingRoles = metadata.listRoles(session, catalog);\n        if (!existingRoles.contains(role)) {\n            throw new SemanticException(MISSING_ROLE, statement, \"Role '%s' does not exist\", role);\n        }\n        metadata.dropRole(session, role, catalog);\n        return immediateFuture(null);\n    }\n}\n","sourceCodeStart":32,"sourceCodeEnd":56,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-main-base/src/main/java/com/facebook/presto/execution/DropRoleTask.java#L32-L56","documentation":"Thrown by DropRoleTask.execute when DROP ROLE names a role that is not in the set returned by metadata.listRoles for the target catalog. The role listing is fetched from the connector's system access control, so the role must exist in that specific catalog.","triggerScenarios":"DROP ROLE role_name where the lowercase role name is absent from metadata.listRoles(session, catalog) for the catalog derived via createCatalogName(session, statement); runs from runQuery after checkCanDropRole passes.","commonSituations":"Role defined in a different catalog than the one the session context resolves to; role already dropped; case-sensitivity confusion (name is lowercased before comparison); role exists in the identity provider but not registered with the connector's system access control.","solutions":["List existing roles to confirm the exact name: SELECT * FROM <catalog>.information_schema.roles or the connector's role listing.","Verify the statement targets the catalog where the role was created (e.g. DROP ROLE x IN catalog if supported by your syntax/connector).","Check the connector's system access control configuration; the role may need to be created there first (CREATE ROLE)."],"exampleFix":"// before\nDROP ROLE Admin; -- wrong catalog, role lives in 'hive'\n// after\nDROP ROLE admin IN hive;","handlingStrategy":"validation","validationCode":"-- list roles in the target catalog first\nSELECT role_name FROM <catalog>.information_schema.roles;\n-- only issue DROP ROLE if the lowercased name is present","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always use lowercase role names in scripts to match getValueLowerCase comparison.","Specify the correct catalog context when creating and dropping roles.","Treat role provisioning as catalog-scoped: create and drop in the same catalog."],"tags":["sql","security","roles"],"backgroundTag":"role-does-not-exist","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}