{"record":{"id":"4edc04631a2dcf30","repo":"prestodb/presto","slug":"cannot-show-role-grants-from-catalog-s","errorCode":null,"errorMessage":"Cannot show role grants from catalog %s","messagePattern":"Cannot show role grants from catalog (.+?)","errorType":"exception","errorClass":"AccessDeniedException","httpStatus":null,"severity":"error","filePath":"presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java","lineNumber":347,"sourceCode":"\n    public static void denyRevokeTablePrivilege(String privilege, String tableName, String extraInfo)\n    {\n        throw new AccessDeniedException(format(\"Cannot revoke privilege %s on table %s%s\", privilege, tableName, formatExtraInfo(extraInfo)));\n    }\n\n    public static void denyShowRoles(String catalogName)\n    {\n        throw new AccessDeniedException(format(\"Cannot show roles from catalog %s\", catalogName));\n    }\n\n    public static void denyShowCurrentRoles(String catalogName)\n    {\n        throw new AccessDeniedException(format(\"Cannot show current roles from catalog %s\", catalogName));\n    }\n\n    public static void denyShowRoleGrants(String catalogName)\n    {\n        throw new AccessDeniedException(format(\"Cannot show role grants from catalog %s\", catalogName));\n    }\n\n    public static void denySetSystemSessionProperty(String propertyName)\n    {\n        denySetSystemSessionProperty(propertyName, null);\n    }\n\n    public static void denySetSystemSessionProperty(String propertyName, String extraInfo)\n    {\n        throw new AccessDeniedException(format(\"Cannot set system session property %s%s\", propertyName, formatExtraInfo(extraInfo)));\n    }\n\n    public static void denySetCatalogSessionProperty(String catalogName, String propertyName)\n    {\n        denySetCatalogSessionProperty(catalogName, propertyName, null);\n    }\n\n    public static void denySetCatalogSessionProperty(String catalogName, String propertyName, String extraInfo)","sourceCodeStart":329,"sourceCodeEnd":365,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java#L329-L365","documentation":"This AccessDeniedException is thrown by denyShowRoleGrants when the active security layer (system access control or connector authorizer) rejects a SHOW ROLE GRANTS request for a catalog. Presto's security model centralizes authorization in AccessControlManager, which calls checkCanShowRoleGrants on the configured access control; any denial is funneled here. The user's identity simply lacks the SHOW_ROLE_GRANTS privilege in that catalog.","triggerScenarios":"Running 'SHOW ROLE GRANTS FROM <catalog>' (or SET ROLE-related introspection) when the access control's checkCanShowRoleGrants denies the session user for that catalogName.","commonSituations":"Developers querying role grants without being a security admin; catalogs whose access control only lets certain principals inspect role mappings; misreading a policy file (e.g. file-based system access control) that omits the user from admin rules.","solutions":["Request SHOW_ROLE_GRANTS privilege or security-admin role on the catalog from your administrator.","Review the configured access control rules (etc/access-control.properties or connector authorizer) and add an allow rule for the principal.","Verify you are connected to the intended catalog; grants are per-catalog.","As a non-admin, ask the admin to run the query and share the output."],"exampleFix":"// before: denied for regular user\nSHOW ROLE GRANTS FROM hive;\n// after: run as a user granted admin in the access control rules, e.g.\n// access-control.properties: security-admin-user=bob\n// then, as bob:\nSHOW ROLE GRANTS FROM hive;","handlingStrategy":"try-catch","validationCode":"// Check privileges before SHOW ROLE GRANTS:\n// SELECT * FROM system.security.roles();  or consult your access-control config\nboolean canShowRoleGrants = currentUserHasSystemAccessControlRuleFor(\"SHOW_ROLE_GRANTS\", catalogName);","typeGuard":null,"tryCatchPattern":"try {\n    session.execute(\"SHOW ROLE GRANTS FROM \" + catalogName);\n} catch (AccessDeniedException e) {\n    // SQLSTATE: insufficient privileges — surface to admin or fall back to admin-run query\n    log.warn(\"Not permitted to show role grants in {}: {}\", catalogName, e.getMessage());\n}","preventionTips":["Grant SHOW_ROLE_GRANTS (or admin) to service principals that introspect roles.","Keep access-control rule files under version control and review before rollout.","Test privilege checks in a staging catalog with the same policies."],"tags":["security","authorization","access-control","roles"],"backgroundTag":"access-denied-authorization","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}