{"record":{"id":"3c34f07434b7b8a9","repo":"prestodb/presto","slug":"cannot-set-catalog-session-property-s","errorCode":null,"errorMessage":"Cannot set catalog session property %s","messagePattern":"Cannot set catalog session property (.+?)","errorType":"exception","errorClass":"AccessDeniedException","httpStatus":null,"severity":"error","filePath":"presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java","lineNumber":372,"sourceCode":"\n    public static void denySetSystemSessionProperty(String propertyName, String extraInfo)\n    {\n        throw new AccessDeniedException(format(\"Cannot set system session property %s%s\", propertyName, formatExtraInfo(extraInfo)));\n    }\n\n    public static void denySetCatalogSessionProperty(String catalogName, String propertyName)\n    {\n        denySetCatalogSessionProperty(catalogName, propertyName, null);\n    }\n\n    public static void denySetCatalogSessionProperty(String catalogName, String propertyName, String extraInfo)\n    {\n        throw new AccessDeniedException(format(\"Cannot set catalog session property %s.%s%s\", catalogName, propertyName, formatExtraInfo(extraInfo)));\n    }\n\n    public static void denySetCatalogSessionProperty(String propertyName)\n    {\n        throw new AccessDeniedException(format(\"Cannot set catalog session property %s\", propertyName));\n    }\n\n    public static void denySelectColumns(String tableName, Collection<String> columnNames)\n    {\n        denySelectColumns(tableName, columnNames, null);\n    }\n\n    public static void denySelectColumns(String tableName, Collection<String> columnNames, String extraInfo)\n    {\n        throw new AccessDeniedException(format(\"Cannot select from columns %s in table or view %s%s\", columnNames.stream().sorted().collect(Collectors.toList()), tableName, formatExtraInfo(extraInfo)));\n    }\n\n    public static void denyCallProcedure(String procedureName)\n    {\n        denyCallProcedure(procedureName, null);\n    }\n\n    public static void denyCallProcedure(String procedureName, String extraInfo)","sourceCodeStart":354,"sourceCodeEnd":390,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java#L354-L390","documentation":"Overload of denySetCatalogSessionProperty taking only the propertyName; it throws the same AccessDeniedException without a catalog prefix in the message. It is used when the denial applies to a catalog session property where the catalog is implicit/unavailable in the check. Semantically identical to the catalog+property variant: the user may not change that connector session property.","triggerScenarios":"The same SET SESSION on a connector property, routed through the single-argument overload when the authorizer denies without catalog context.","commonSituations":"Same as the catalog-qualified variant: restricted connector properties, shared clusters with locked-down tuning knobs, hardcoded session settings in legacy clients.","solutions":["Remove the session property override from the client/JDBC config.","Request that the property be allowed for your principal in access control rules.","Set the value in the connector's catalog properties file instead of per-session.","Check property spelling and that it is a real connector property."],"exampleFix":"// before\nSET SESSION oracle.fetch_size = 50000;\n// after\n-- removed; rely on catalog default or ask admin to permit it","handlingStrategy":"validation","validationCode":"// Same guard, single-argument path\nif (!isCatalogPropertyAllowedForUser(currentCatalog, propertyName, currentUser)) {\n    skipSessionPropertyOverride(propertyName);\n}","typeGuard":null,"tryCatchPattern":"try {\n    stmt.execute(\"SET SESSION \" + prop + \" = \" + value);\n} catch (AccessDeniedException e) {\n    log.warn(\"Session property {} denied; keeping default\", prop);\n}","preventionTips":["Avoid per-session connector property overrides in shared clusters.","Centralize permitted session settings in one reviewed config module.","Log attempted overrides so denials are visible in monitoring."],"tags":["security","session-properties","access-control","connector"],"backgroundTag":"access-denied-authorization","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}