{"record":{"id":"6326a5f735f6a2d9","repo":"apache/dolphinscheduler","slug":"30001-6326a5","errorCode":"30001","errorMessage":"user has no operation privilege","messagePattern":"user has no operation privilege","errorType":"error_code","errorClass":"ServiceException","httpStatus":null,"severity":"error","filePath":"dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/TenantServiceImpl.java","lineNumber":139,"sourceCode":"    }\n\n    /**\n     * create tenant\n     *\n     * @param loginUser login user\n     * @param tenantCode tenant code\n     * @param queueId queue id\n     * @param desc description\n     * @return create result code\n     */\n    @Override\n    @Transactional(rollbackFor = Exception.class)\n    public Tenant createTenant(User loginUser,\n                               String tenantCode,\n                               int queueId,\n                               String desc) {\n        if (!canOperatorPermissions(loginUser, null, AuthorizationType.TENANT, TENANT_CREATE)) {\n            throw new ServiceException(Status.USER_NO_OPERATION_PERM);\n        }\n        if (checkDescriptionLength(desc)) {\n            throw new ServiceException(Status.DESCRIPTION_TOO_LONG_ERROR);\n        }\n        Tenant tenant = new Tenant(tenantCode, desc, queueId);\n        createTenantValid(tenant);\n        tenantDao.insert(tenant);\n\n        return tenant;\n    }\n\n    /**\n     * query tenant list paging\n     *\n     * @param loginUser login user\n     * @param searchVal search value\n     * @param pageNo    page number\n     * @param pageSize  page size","sourceCodeStart":121,"sourceCodeEnd":157,"githubUrl":"https://github.com/apache/dolphinscheduler/blob/02eac45a1b6676e639fcbfb4be2243de5771b05d/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/TenantServiceImpl.java#L121-L157","documentation":"createTenant first checks canOperatorPermissions(loginUser, null, AuthorizationType.TENANT, TENANT_CREATE); users lacking tenant-management privileges get USER_NO_OPERATION_PERM (code 30001). This is an RBAC authorization guard, not an authentication failure.","triggerScenarios":"POST /dolphinscheduler/tenants/create by a logged-in user without TENANT create permission in their role.","commonSituations":"Regular (non-admin) users attempting tenant creation; roles missing the TENANT authorization scope; calling the API directly with a low-privilege sessionId cookie.","solutions":["Log in as or elevate the user to a role with TENANT management permission","Have an admin grant the TENANT create authorization to the user's role","Use a service account with tenant-admin privileges for automation"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"boolean canCreate = user.getUserType() == UserType.ADMIN_USER;","typeGuard":null,"tryCatchPattern":"try { tenantService.createTenant(user, code, queueId, desc); } catch (ServiceException e) { if (e.getCode() == 30001) { throw new SecurityException(\"TENANT create permission required\"); } }","preventionTips":["Confirm the account's role grants TENANT authorization before automating","Use admin/service accounts for tenant lifecycle operations","Check permissions in the UI security center first"],"tags":["authorization","rbac","tenant"],"backgroundTag":"permission-denied","analyzedSha":"02eac45a1b6676e639fcbfb4be2243de5771b05d","analyzedAt":"2026-09-06T17:43:00.555Z","contentChangedAt":"2026-09-06T17:43:00.555Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}