{"record":{"id":"42e53d5f9ceaecf2","repo":"apache/hadoop","slug":"user-not-in-httpfsserver-admin-group","errorCode":null,"errorMessage":"User not in HttpFSServer admin group","messagePattern":"User not in HttpFSServer admin group","errorType":"exception","errorClass":"AccessControlException","httpStatus":401,"severity":"error","filePath":"hadoop-hdfs-project/hadoop-hdfs-httpfs/src/main/java/org/apache/hadoop/fs/http/server/HttpFSServer.java","lineNumber":336,"sourceCode":"      Map json = fsExecute(user, command);\n      AUDIT_LOG.info(\"[{}] filter [{}]\", path, (filter != null) ? filter : \"-\");\n      response = Response.ok(json).type(MediaType.APPLICATION_JSON).build();\n      break;\n    }\n    case GETHOMEDIRECTORY: {\n      enforceRootPath(op.value(), path);\n      FSOperations.FSHomeDir command = new FSOperations.FSHomeDir();\n      JSONObject json = fsExecute(user, command);\n      AUDIT_LOG.info(\"Home Directory for [{}]\", user);\n      response = Response.ok(json).type(MediaType.APPLICATION_JSON).build();\n      break;\n    }\n    case INSTRUMENTATION: {\n      enforceRootPath(op.value(), path);\n      Groups groups = HttpFSServerWebApp.get().get(Groups.class);\n      Set<String> userGroups = groups.getGroupsSet(user.getShortUserName());\n      if (!userGroups.contains(HttpFSServerWebApp.get().getAdminGroup())) {\n        throw new AccessControlException(\n            \"User not in HttpFSServer admin group\");\n      }\n      Instrumentation instrumentation =\n          HttpFSServerWebApp.get().get(Instrumentation.class);\n      Map snapshot = instrumentation.getSnapshot();\n      response = Response.ok(snapshot).build();\n      break;\n    }\n    case GETCONTENTSUMMARY: {\n      FSOperations.FSContentSummary command =\n          new FSOperations.FSContentSummary(path);\n      Map json = fsExecute(user, command);\n      AUDIT_LOG.info(\"Content summary for [{}]\", path);\n      response = Response.ok(json).type(MediaType.APPLICATION_JSON).build();\n      break;\n    }\n    case GETQUOTAUSAGE: {\n      FSOperations.FSQuotaUsage command =","sourceCodeStart":318,"sourceCodeEnd":354,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-hdfs-project/hadoop-hdfs-httpfs/src/main/java/org/apache/hadoop/fs/http/server/HttpFSServer.java#L318-L354","documentation":"The INSTRUMENTATION operation exposes HttpFS server metrics and is restricted to members of the admin group (httpfs.admin.group, default 'hadoop'). HttpFSServer resolves the authenticated user's group set via the Groups service; if the admin group is not among them, it throws AccessControlException('User not in HttpFSServer admin group'), which surfaces to the client as HTTP 403.","triggerScenarios":"GET /webhdfs/v1/?op=INSTRUMENTATION&user.name=bob where bob is not in the configured admin group; admin group configured to a group that does not exist in the name service (so nobody resolves into it); stale group mapping cache after the user was just added to the group.","commonSituations":"Monitoring systems polling HttpFS metrics with a service account that was never granted admin; defaulting to httpfs.admin.group=hadoop when the org uses a different admin group; group-provider (LDAP) outage making group resolution incomplete.","solutions":["Add the requesting user to the group named by httpfs.admin.group (default: hadoop): usermod -aG hadoop bob, then log in again (groups are resolved at request time — also mind the group-mapping cache).","If the org's admin group differs, set httpfs.admin.group in httpfs-site.xml to the real group name and restart HttpFS.","Verify resolution with `id bob` on the HttpFS host and with the hadoop group-mapping used by the server."],"exampleFix":"<!-- before: httpfs-site.xml -->\n<property><name>httpfs.admin.group</name><value>hadoop</value></property>\n\n<!-- after -->\n<property><name>httpfs.admin.group</name><value>httpfs-admins</value></property>\n\n# then ensure the polling user is in that group and restart httpfs","handlingStrategy":"try-catch","validationCode":"// client: verify group membership before calling (best effort)\nUserGroupInformation ugi = UserGroupInformation.getLoginUser();\nString adminGroup = conf.get(\"httpfs.admin.group\", \"hadoop\");\nif (!ugi.getGroupSets().stream().flatMap(Collection::stream).anyMatch(adminGroup::equals)) {\n  LOG.warn(\"{} lacks admin group {}; INSTRUMENTATION will 403\", ugi, adminGroup);\n}","typeGuard":null,"tryCatchPattern":"try {\n  metrics = client.get(url + \"/webhdfs/v1/?op=INSTRUMENTATION\");\n} catch (HttpResponseException e) {\n  if (e.getStatusCode() == 403) {\n    // not in httpfs.admin.group: grant group or change httpfs.admin.group\n    LOG.warn(\"access denied for instrumentation: {}\", e.getMessage());\n  } else throw e;\n}","preventionTips":["Poll metrics with a dedicated service account placed in the admin group.","Set httpfs.admin.group explicitly to an existing group instead of relying on the 'hadoop' default.","Remember group-mapping caches: re-login or wait after group changes."],"tags":["httpfs","authorization","access-control","instrumentation","configuration","http-403"],"backgroundTag":"access-denied","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}