{"record":{"id":"4fbf4bba84080c6f","repo":"prestodb/presto","slug":"hive-connector-does-not-support-granted-by-stateme","errorCode":null,"errorMessage":"Hive Connector does not support GRANTED BY statement","messagePattern":"Hive Connector does not support GRANTED BY statement","errorType":"exception","errorClass":"AccessDeniedException","httpStatus":null,"severity":"error","filePath":"presto-hive/src/main/java/com/facebook/presto/hive/security/SqlStandardAccessControl.java","lineNumber":526,"sourceCode":"            denyCreateRole(role);\n        }\n    }\n\n    @Override\n    public void checkCanDropRole(ConnectorTransactionHandle transactionHandle, ConnectorIdentity identity, AccessControlContext context, String role)\n    {\n        MetastoreContext metastoreContext = createMetastoreContext(identity, context);\n        if (!isAdmin(transactionHandle, identity, metastoreContext)) {\n            denyDropRole(role);\n        }\n    }\n\n    @Override\n    public void checkCanGrantRoles(ConnectorTransactionHandle transactionHandle, ConnectorIdentity identity, AccessControlContext context, Set<String> roles, Set<PrestoPrincipal> grantees, boolean withAdminOption, Optional<PrestoPrincipal> grantor, String catalogName)\n    {\n        // currently specifying grantor is supported by metastore, but it is not supported by Hive itself\n        if (grantor.isPresent()) {\n            throw new AccessDeniedException(\"Hive Connector does not support GRANTED BY statement\");\n        }\n        MetastoreContext metastoreContext = createMetastoreContext(identity, context);\n        if (!hasAdminOptionForRoles(transactionHandle, identity, metastoreContext, roles)) {\n            denyGrantRoles(roles, grantees);\n        }\n    }\n\n    @Override\n    public void checkCanRevokeRoles(ConnectorTransactionHandle transactionHandle, ConnectorIdentity identity, AccessControlContext context, Set<String> roles, Set<PrestoPrincipal> grantees, boolean adminOptionFor, Optional<PrestoPrincipal> grantor, String catalogName)\n    {\n        // currently specifying grantor is supported by metastore, but it is not supported by Hive itself\n        if (grantor.isPresent()) {\n            throw new AccessDeniedException(\"Hive Connector does not support GRANTED BY statement\");\n        }\n        MetastoreContext metastoreContext = createMetastoreContext(identity, context);\n        if (!hasAdminOptionForRoles(transactionHandle, identity, metastoreContext, roles)) {\n            denyRevokeRoles(roles, grantees);\n        }","sourceCodeStart":508,"sourceCodeEnd":544,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-hive/src/main/java/com/facebook/presto/hive/security/SqlStandardAccessControl.java#L508-L544","documentation":"The Hive connector's SQL-standard access control rejects GRANT ROLE statements that include a GRANTED BY clause. While the Hive metastore can store a grantor, Hive itself does not support specifying one, so checkCanGrantRoles throws AccessDeniedException before any metastore call is made.","triggerScenarios":"Executing GRANT role TO principal GRANTED BY grantor against a Hive catalog, which reaches SqlStandardAccessControl.checkCanGrantRoles with grantor present.","commonSituations":"Tools or migration scripts generated for other catalogs (e.g. Postgres-style grants) that always emit GRANTED BY; BI/admin tools adding the clause by default; replicated DDL from another engine.","solutions":["Remove the GRANTED BY clause from the GRANT ROLE statement","Run the grant as the intended grantor user instead of using GRANTED BY","Use a connector/access-control that supports grantor specification (e.g. system-level access control or a different catalog)"],"exampleFix":"// before\nGRANT admin TO USER alice GRANTED BY USER bob;\n// after\nGRANT admin TO USER alice;","handlingStrategy":"validation","validationCode":"// before submitting DDL against a Hive catalog\nif (grantSql.toLowerCase().contains(\"granted by\")) {\n    throw new IllegalArgumentException(\"Hive connector does not support GRANTED BY\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    executeGrant(sql);\n} catch (AccessDeniedException e) {\n    if (e.getMessage().contains(\"GRANTED BY\")) {\n        executeGrant(sql.replaceAll(\"(?i)granted\\\\s+by\\\\s+\\\\S+\\\\s+USER\\\\s+\\\\S+\", \"\").trim());\n    } else throw e;\n}","preventionTips":["Never emit GRANTED BY in generated SQL targeting Hive catalogs","Run grants as the actual granting user rather than impersonating via GRANTED BY","Audit migration scripts written for other engines before running them on Hive"],"tags":["hive","access-control","authorization","sql"],"backgroundTag":"unsupported-sql-feature","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}