{"record":{"id":"39eb9abe8b21ea39","repo":"apache/hadoop","slug":"getaclstatus-operation-is-only-supported-on-hns-en","errorCode":null,"errorMessage":"GetAclStatus operation is only supported on HNS enabled Accounts.","messagePattern":"GetAclStatus operation is only supported on HNS enabled Accounts\\.","errorType":"exception","errorClass":"UnsupportedOperationException","httpStatus":null,"severity":"error","filePath":"hadoop-tools/hadoop-azure/src/main/java/org/apache/hadoop/fs/azurebfs/services/AbfsBlobClient.java","lineNumber":1474,"sourceCode":"      final TracingContext tracingContext) throws AzureBlobFileSystemException {\n    throw new UnsupportedOperationException(\n        \"SetAcl operation is only supported on HNS enabled Accounts.\");\n  }\n\n  /**\n   * Get the ACL of the file or directory.\n   * Not supported for HNS-Disabled Accounts.\n   * @param path of which properties have to be fetched.\n   * @param useUPN whether to use UPN with rest operation.\n   * @param tracingContext for tracing the server calls.\n   * @return exception as this operation is not supported on Blob Endpoint.\n   * @throws UnsupportedOperationException always.\n   */\n  @Override\n  public AbfsRestOperation getAclStatus(final String path,\n      final boolean useUPN,\n      TracingContext tracingContext) throws AzureBlobFileSystemException {\n    throw new UnsupportedOperationException(\n        \"GetAclStatus operation is only supported on HNS enabled Accounts.\");\n  }\n\n  /**\n   * Check the access of the file or directory.\n   * Not supported for HNS-Disabled Accounts.\n   * @param path  Path for which access check needs to be performed\n   * @param rwx   The permission to be checked on the path\n   * @param tracingContext Tracks identifiers for request header\n   * @return exception as this operation is not supported on Blob Endpoint.\n   * @throws UnsupportedOperationException always.\n   */\n  @Override\n  public AbfsRestOperation checkAccess(String path,\n      String rwx,\n      TracingContext tracingContext) throws AzureBlobFileSystemException {\n    throw new UnsupportedOperationException(\n        \"CheckAccess operation is only supported on HNS enabled Accounts.\");","sourceCodeStart":1456,"sourceCodeEnd":1492,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-tools/hadoop-azure/src/main/java/org/apache/hadoop/fs/azurebfs/services/AbfsBlobClient.java#L1456-L1492","documentation":"AbfsBlobClient.getAclStatus is a stub for non-HNS accounts and always throws UnsupportedOperationException('GetAclStatus operation is only supported on HNS enabled Accounts.'). Reading named ACLs requires hierarchical namespace; flat-namespace accounts have no per-path ACL to return, so even read access fails client-side.","triggerScenarios":"Calling fs.getAclStatus(path) on an abfs:// URI backed by an account with hierarchical namespace disabled — e.g. audit tooling, distcp -p querying source ACLs, or code that inspects ACLs before copying.","commonSituations":"Compliance/audit scripts iterating all mounted filesystems; backup tools that snapshot ACLs; permission-preserving copies probing target capabilities.","solutions":["Enable HNS on the account when ACL introspection is required","Feature-detect and skip getAclStatus for non-HNS filesystems in shared tooling","Model flat-namespace access with Azure RBAC role assignments instead of per-path ACLs"],"exampleFix":"// before\nAclStatus st = fs.getAclStatus(path);\n\n// after\nif (isHnsAccount(fs)) {\n  AclStatus st = fs.getAclStatus(path);\n} else {\n  // no per-path ACLs exist on this account\n}","handlingStrategy":"validation","validationCode":"AclStatus st = isHnsAccount(fs)\n    ? fs.getAclStatus(path)\n    : null; // no per-path ACLs exist on non-HNS accounts","typeGuard":"private static boolean supportsAclStatus(FileSystem fs) {\n  return !(fs instanceof AzureBlobFileSystem)\n      || fs.getConf().getBoolean(\"fs.azure.account.hns.enabled\", false);\n}","tryCatchPattern":"try {\n  return fs.getAclStatus(path);\n} catch (UnsupportedOperationException e) {\n  // non-HNS account: report \"no ACL information available\" instead of failing\n  return new AclStatus.Builder().build();\n}","preventionTips":["Audit scripts should feature-detect ACL support per filesystem","Backup tools: record 'ACLs unavailable' rather than aborting on non-HNS mounts","Enable HNS when ACL introspection is a hard requirement"],"tags":["azure","abfs","unsupported-operation","hns","acl"],"backgroundTag":"unsupported-operation","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}