{"record":{"id":"2a8d98d5b59e1f3b","repo":"prestodb/presto","slug":"user-s-not-a-member-of-the-authorized-group","errorCode":null,"errorMessage":"User [%s] not a member of the authorized group","messagePattern":"User \\[(.+?)\\] not a member of the authorized group","errorType":"http","errorClass":"AccessDeniedException","httpStatus":401,"severity":"warning","filePath":"presto-password-authenticators/src/main/java/com/facebook/presto/password/ldap/LdapAuthenticator.java","lineNumber":168,"sourceCode":"        String searchFilter = replaceUser(groupAuthorizationSearchPattern.get(), user);\n        SearchControls searchControls = new SearchControls();\n        searchControls.setSearchScope(SearchControls.SUBTREE_SCOPE);\n\n        boolean authorized;\n        try {\n            NamingEnumeration<SearchResult> search = context.search(userBase, searchFilter, searchControls);\n            authorized = search.hasMoreElements();\n            search.close();\n        }\n        catch (NamingException e) {\n            log.debug(\"Authentication error for user [%s]: %s\", user, e.getMessage());\n            throw new RuntimeException(\"Authentication error\");\n        }\n\n        if (!authorized) {\n            String message = format(\"User [%s] not a member of the authorized group\", user);\n            log.debug(message);\n            throw new AccessDeniedException(message);\n        }\n    }\n\n    private static String replaceUser(String pattern, String user)\n    {\n        return pattern.replaceAll(\"\\\\$\\\\{USER}\", user);\n    }\n\n    private static void closeContext(DirContext context)\n    {\n        try {\n            context.close();\n        }\n        catch (NamingException ignored) {\n        }\n    }\n\n    private static class Credentials","sourceCodeStart":150,"sourceCodeEnd":186,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-password-authenticators/src/main/java/com/facebook/presto/password/ldap/LdapAuthenticator.java#L150-L186","documentation":"Thrown by LdapAuthenticator.checkForGroupMembership when the LDAP search for the user in the authorized group completes successfully but returns no results (search.hasMoreElements() is false). The user authenticated (or the search ran) but is not a member of the group configured via presto.password.authenticator.ldap group-authentication settings, so access is denied with AccessDeniedException.","triggerScenarios":"checkForGroupMembership performs context.search(userBase, searchFilter, searchControls) and the result enumeration is empty: the user DN does not match searchFilter, the user is not in the required LDAP group, or groupBase/groupAuthSearchFilter point at the wrong subtree.","commonSituations":"User removed from the required LDAP group (e.g. after team change); group-authentication-search-filter or group-base-dn misconfigured so membership is searched in the wrong subtree; nested groups not matched because LDAP does not expand them with the configured filter (missing objectClass:groupOfNames nesting support); using member vs memberOf attribute mismatch.","solutions":["Confirm the user is actually a member of the required group: run ldapsearch with the same group filter and base DN the connector uses","Check that ldap.group-base-dn and ldap.group-authentication-search-filter match your directory schema (member vs memberOf, correct objectClass)","If nested groups are needed, use a filter that supports transitive membership (e.g. LDAP_MATCHING_RULE_IN_CHAIN member:1.2.840.113556.1.4.1941:= on AD) or add the user to the direct group","Ask the directory admin to add the user to the authorized group","If group checks are not desired, remove the group-authentication properties so only password auth is enforced"],"exampleFix":"// before (wrong attribute for directory)\nldap.group-authentication-search-filter=(&(objectClass=groupOfNames)(member=${USER}))\n// after (memberOf attribute on the user entry)\nldap.group-authentication-search-filter=(&(objectClass=group)(memberOf=cn=presto-admins,ou=groups,dc=example,dc=com))","handlingStrategy":"validation","validationCode":"# Verify group membership with the exact configured base and filter before attempting login\nldapsearch -x -H ldaps://ldap.example.com:636 -D 'cn=svc,dc=example,dc=com' -W \\\n  -b 'ou=groups,dc=example,dc=com' \\\n  '(&(objectClass=groupOfNames)(member=uid=testuser,ou=people,dc=example,dc=com))' dn","typeGuard":null,"tryCatchPattern":"try {\n  ldapAuthenticator.authenticate(user, password);\n} catch (AccessDeniedException e) {\n  // message: 'User [x] not a member of the authorized group'\n  throw new AuthenticationException(\"Not authorized: you must be a member of the required LDAP group\");\n}","preventionTips":["Automate group membership audits so users are not silently removed from the access group","Keep group-base-dn and group-authentication-search-filter in version-controlled config and test with ldapsearch on change","Use a filter consistent with your directory's membership model (member vs memberOf vs nested-group matching rule)","Document the required group name to users so they can request access directly","Distinguish 'bad password' from 'missing group' in monitoring via the different exception messages"],"tags":["ldap","authorization","access-denied","group-membership","presto"],"backgroundTag":"ldap-group-membership-denied","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}