{"record":{"id":"747878e08fff1a60","repo":"apache/hadoop","slug":"user-s-is-not-authorized-to-create-key","errorCode":null,"errorMessage":"User [%s] is not authorized to create key !!","messagePattern":"User \\[(.+?)\\] is not authorized to create key !!","errorType":"exception","errorClass":"AuthorizationException","httpStatus":403,"severity":"error","filePath":"hadoop-common-project/hadoop-kms/src/main/java/org/apache/hadoop/crypto/key/kms/server/KeyAuthorizationKeyProvider.java","lineNumber":135,"sourceCode":"    String aclName = attributes.get(KEY_ACL_NAME);\n    boolean success = false;\n    if (Strings.isNullOrEmpty(aclName)) {\n      if (acls.isACLPresent(keyName, KeyOpType.MANAGEMENT)) {\n        options.setAttributes(ImmutableMap.<String, String> builder()\n            .putAll(attributes).put(KEY_ACL_NAME, keyName).build());\n        success =\n            acls.hasAccessToKey(keyName, ugi, KeyOpType.MANAGEMENT)\n                || acls.hasAccessToKey(keyName, ugi, KeyOpType.ALL);\n      } else {\n        success = false;\n      }\n    } else {\n      success = acls.isACLPresent(aclName, KeyOpType.MANAGEMENT) &&\n          (acls.hasAccessToKey(aclName, ugi, KeyOpType.MANAGEMENT)\n          || acls.hasAccessToKey(aclName, ugi, KeyOpType.ALL));\n    }\n    if (!success)\n      throw new AuthorizationException(String.format(\"User [%s] is not\"\n          + \" authorized to create key !!\", ugi.getShortUserName()));\n  }\n\n  private void checkAccess(String aclName, UserGroupInformation ugi,\n      KeyOpType opType) throws AuthorizationException {\n    Preconditions.checkNotNull(aclName, \"Key ACL name cannot be null\");\n    Preconditions.checkNotNull(ugi, \"UserGroupInformation cannot be null\");\n    if (acls.isACLPresent(aclName, opType) &&\n        (acls.hasAccessToKey(aclName, ugi, opType)\n            || acls.hasAccessToKey(aclName, ugi, KeyOpType.ALL))) {\n      return;\n    } else {\n      throw new AuthorizationException(String.format(\"User [%s] is not\"\n          + \" authorized to perform [%s] on key with ACL name [%s]!!\",\n          ugi.getShortUserName(), opType, aclName));\n    }\n  }\n","sourceCodeStart":117,"sourceCodeEnd":153,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-kms/src/main/java/org/apache/hadoop/crypto/key/kms/server/KeyAuthorizationKeyProvider.java#L117-L153","documentation":"KeyAuthorizationKeyProvider wraps the backing KeyProvider and enforces per-key ACLs. Before creating a key it resolves the key's ACL name (the key.acl.name attribute, defaulting to the key name) and requires the caller to pass hadoop.kms.acl-style key ACLs for MANAGEMENT or ALL on that ACL name (key.acl.<aclname>.MANAGEMENT / .ALL in kms-acls.xml, or the whitelist key.acl entries). On failure it throws AuthorizationException 'User [<name>] is not authorized to create key !!', surfaced as HTTP 403.","triggerScenarios":"POST /v1/key (or KeyProvider.createKey) where kms-acls.xml has no key.acl.<aclname>.MANAGEMENT (nor .ALL) entry for the key's ACL name, or the user is absent from it; also when the KMS ACL CREATE check passed but the per-key MANAGEMENT check did not — key-level ACLs are stricter than the server-level ones.","commonSituations":"Creating keys without provisioning key.acl.<name>.MANAGEMENT entries first; teams expecting server-wide hadoop.kms.acl.CREATE to be sufficient; ACL-name mismatch between the key.acl.name attribute supplied at creation and the entry configured in kms-acls.xml.","solutions":["Add an entry to kms-acls.xml: key.acl.<aclname>.MANAGEMENT (or key.acl.<aclname>.ALL) containing the creating user/group","Ensure the ACL name matches what the client sends in the key.acl.name attribute (defaults to the key name)","Rely on the hot reload of kms-acls.xml or restart KMS, then retry the create","Give the creator the broader .ALL key ACL if that user should manage all operations on the key"],"exampleFix":"<!-- kms-acls.xml -->\n<property>\n  <name>key.acl.mykey.MANAGEMENT</name>\n  <value>hdfs,kmadmin</value>\n</property>","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try { provider.createKey(name, options); } catch (AuthorizationException e) { // 403: user not in key.acl.<name>.MANAGEMENT/ALL — provision the ACL, do not retry }","preventionTips":["Provision key.acl.<aclname>.MANAGEMENT before any client creates that key","Keep the key.acl.name attribute and the kms-acls.xml entry name in sync","Automate key onboarding (ACL entry + create) in one runbook step"],"tags":["hadoop-kms","authorization","http-403","key-acl","security","key-management"],"backgroundTag":"authorization-denied-acl","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}