{"record":{"id":"2bc42ec553171b7f","repo":"dgraph-io/dgraph","slug":"cannot-force-namespace-x-when-provided-creds-are","errorCode":null,"errorMessage":"cannot force namespace %#x when provided creds are not of superadmin user","messagePattern":"cannot force namespace %#x when provided creds are not of superadmin user","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"dgraph/cmd/live/run.go","lineNumber":700,"sourceCode":"\t\thttpAddr:        Live.Conf.GetString(\"http\"),\n\t\tbufferSize:      Live.Conf.GetInt(\"bufferSize\"),\n\t\tupsertPredicate: Live.Conf.GetString(\"upsertPredicate\"),\n\t\ttmpDir:          Live.Conf.GetString(\"tmp\"),\n\t\tkey:             keys.EncKey,\n\t}\n\n\tforceNs := Live.Conf.GetInt64(\"force-namespace\")\n\tswitch creds.GetUint64(\"namespace\") {\n\tcase x.RootNamespace:\n\t\tif forceNs < 0 {\n\t\t\topt.preserveNs = true\n\t\t\topt.namespaceToLoad = math.MaxUint64\n\t\t} else {\n\t\t\topt.namespaceToLoad = uint64(forceNs)\n\t\t}\n\tdefault:\n\t\tif Live.Conf.IsSet(\"force-namespace\") {\n\t\t\treturn errors.Errorf(\"cannot force namespace %#x when provided creds are not of\"+\n\t\t\t\t\" superadmin user\", forceNs)\n\t\t}\n\t}\n\n\tz.SetTmpDir(opt.tmpDir)\n\n\tgo func() {\n\t\tif err := http.ListenAndServe(opt.httpAddr, x.SanitizedDefaultServeMux()); err != nil {\n\t\t\tglog.Errorf(\"Error while starting HTTP server: %+v\", err)\n\t\t}\n\t}()\n\tctx := context.Background()\n\t// singleNsOp is set to false, when loading data into a namespace different from the one user\n\t// provided credentials for.\n\tsingleNsOp := true\n\tif len(creds.GetString(\"user\")) > 0 && creds.GetUint64(\"namespace\") == x.RootNamespace &&\n\t\topt.namespaceToLoad != x.RootNamespace {\n\t\tsingleNsOp = false","sourceCodeStart":682,"sourceCodeEnd":718,"githubUrl":"https://github.com/dgraph-io/dgraph/blob/759e242be62c91f8d084da06ad0c8d21256d9c07/dgraph/cmd/live/run.go#L682-L718","documentation":"The `dgraph live` loader refuses to apply a --force-namespace flag when the credentials used are not those of the Dgraph superadmin (guardians) user. Forcing a target namespace is a superadmin-only operation because it writes into an arbitrary namespace that the normal ACLs would not permit. The check lives in the namespace option resolution switch in run.go and rejects the run before any data is sent to the Alpha.","triggerScenarios":"Running `dgraph live --force-namespace <id> ...` while authenticating with a regular (non-superadmin) user's credentials/hmac key instead of a guardian account's.","commonSituations":"Multi-tenant Dgraph deployments where an operator copies a documented load command but logs in with a limited ACL user; migrating tenants after ACLs were introduced; using an admin key generated for a namespace-restricted user.","solutions":["Run dgraph live with credentials (or --hmac-secret) belonging to the superadmin/guardian user","Remove the --force-namespace flag and load into the namespace your user is authorized for","Create or designate a superadmin user and obtain its credentials before running the loader"],"exampleFix":"// before (regular user creds)\ndgraph live --creds \"user=appUser;password=xxx\" --force-namespace 0x2 -f data.rdf\n// after (superadmin creds)\ndgraph live --creds \"user=groot;password=password\" --force-namespace 0x2 -f data.rdf","handlingStrategy":"validation","validationCode":"// Before running dgraph live with --force-namespace, confirm superadmin creds\n// e.g. verify the user can hit the admin endpoint:\nconst resp = await fetch('http://alpha:8080/admin', {\n  method: 'POST',\n  body: JSON.stringify({ query: '{ checkUser(username: \"groot\", password: \"pw\") { response { code } } }' })\n});\nconst j = await resp.json();\nif (!j.data?.checkUser?.response?.code === 'Success') {\n  throw new Error('Credentials are not superadmin; do not use --force-namespace');\n}","typeGuard":"function isSuperadminLogin(loginResult) {\n  return loginResult?.data?.checkUser?.response?.code === 'Success';\n}","tryCatchPattern":"try {\n  await runLiveLoader({ creds, forceNamespace });\n} catch (e) {\n  if (String(e.message).includes('cannot force namespace')) {\n    console.error('Non-superadmin creds used with --force-namespace; retry as guardian user or drop the flag');\n  } else { throw e; }\n}","preventionTips":["Keep a dedicated superadmin credential set for migration/load jobs only","Never include --force-namespace in generic load scripts; make it opt-in","Verify user privileges via the admin API before long-running loads"],"tags":["permissions","acl","namespace","cli"],"backgroundTag":"insufficient-privileges","analyzedSha":"759e242be62c91f8d084da06ad0c8d21256d9c07","analyzedAt":"2026-09-01T14:42:12.034Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}