{"record":{"id":"189fb644f660a5d8","repo":"apache/hadoop","slug":"user-doesn-t-have-permission-to-call","errorCode":null,"errorMessage":"User {} doesn't have permission to call '{}'","messagePattern":"User (.+?) doesn't have permission to call '(.+?)'","errorType":"exception","errorClass":"AccessControlException","httpStatus":null,"severity":"error","filePath":"hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-hs/src/main/java/org/apache/hadoop/mapreduce/v2/hs/server/HSAdminServer.java","lineNumber":183,"sourceCode":"      user = UserGroupInformation.getCurrentUser();\n    } catch (IOException ioe) {\n      LOG.warn(\"Couldn't get current user\", ioe);\n\n      HSAuditLogger.logFailure(\"UNKNOWN\", method, adminAcl.toString(),\n          HISTORY_ADMIN_SERVER, \"Couldn't get current user\");\n\n      throw ioe;\n    }\n\n    if (!adminAcl.isUserAllowed(user)) {\n      LOG.warn(\"User \" + user.getShortUserName() + \" doesn't have permission\"\n          + \" to call '\" + method + \"'\");\n\n      HSAuditLogger.logFailure(user.getShortUserName(), method,\n          adminAcl.toString(), HISTORY_ADMIN_SERVER,\n          AuditConstants.UNAUTHORIZED_USER);\n\n      throw new AccessControlException(\"User \" + user.getShortUserName()\n          + \" doesn't have permission\" + \" to call '\" + method + \"'\");\n    }\n    LOG.info(\"HS Admin: \" + method + \" invoked by user \"\n        + user.getShortUserName());\n\n    return user;\n  }\n\n  @Override\n  public String[] getGroupsForUser(String user) throws IOException {\n    return UserGroupInformation.createRemoteUser(user).getGroupNames();\n  }\n\n  @Override\n  public void refreshUserToGroupsMappings() throws IOException {\n\n    UserGroupInformation user = checkAcls(\"refreshUserToGroupsMappings\");\n","sourceCodeStart":165,"sourceCodeEnd":201,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-hs/src/main/java/org/apache/hadoop/mapreduce/v2/hs/server/HSAdminServer.java#L165-L201","documentation":"HSAdminServer checks every admin RPC against the admin ACL built from mapreduce.jobhistory.admin.acl (JHAdminConfig.MR_HISTORY_ADMIN_ACL, default '*'). Authentication and proxy rules are applied first; if the authenticated user is not allowed by the ACL, an AccessControlException with this message is thrown, a LOG.warn is emitted, and an HSAuditLogger failure record is written. The exception is by design an authorization denial, not a malfunction.","triggerScenarios":"Invoking HSAdminServer admin operations as a user or group not listed in mapreduce.jobhistory.admin.acl; the ACL restricted to specific users after hardening; group membership not resolving for a group-based ACL entry.","commonSituations":"Operators tightening the admin ACL post-deployment; tooling using a service account never added to the ACL; LDAP/group resolution failures making group entries ineffective.","solutions":["Add the calling user (or their group) to mapreduce.jobhistory.admin.acl in mapred-site.xml and restart JHS.","Verify group resolution for the user if the ACL uses groups (getGroupsForUser).","Run the admin operation as an already-allowed user such as the mapred service account.","Check the HSAuditLogger failure entry to confirm which user and method were denied."],"exampleFix":"<!-- before: only mapred may call admin ops -->\n<property>\n  <name>mapreduce.jobhistory.admin.acl</name>\n  <value>mapred</value>\n</property>\n\n<!-- after: grant the operator user -->\n<property>\n  <name>mapreduce.jobhistory.admin.acl</name>\n  <value>mapred opsalice</value>\n</property>","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  hsAdminClient.someAdminMethod(args);\n} catch (org.apache.hadoop.security.AccessControlException e) {\n  // expected for non-admin users: report which user/method, do not retry unchanged\n  throw new IllegalStateException(\"not in mapreduce.jobhistory.admin.acl: \" + e.getMessage(), e);\n}","preventionTips":["Configure mapreduce.jobhistory.admin.acl with the users and groups that operate JHS.","Run admin tooling as an account listed in the ACL.","Verify group resolution when using group ACL entries."],"tags":["mapreduce","job-history-server","acl","authorization","access-control"],"backgroundTag":"authorization-denied","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}