{"record":{"id":"7ab4353282808232","repo":"apache/hadoop","slug":"is-not-a-super-user","errorCode":null,"errorMessage":"{} is not a super user","messagePattern":"(.+?) is not a super user","errorType":"exception","errorClass":"AccessControlException","httpStatus":null,"severity":"error","filePath":"hadoop-hdfs-project/hadoop-hdfs-rbf/src/main/java/org/apache/hadoop/hdfs/server/federation/router/RouterPermissionChecker.java","lineNumber":132,"sourceCode":"      // Ignore as we catch it afterwards\n    }\n    if (ugi == null) {\n      LOG.error(\"Cannot get the remote user name\");\n      throw new AccessControlException(\"Cannot get the remote user name\");\n    }\n\n    // Is this by the Router user itself?\n    if (ugi.getShortUserName().equals(superUser)) {\n      return;\n    }\n\n    // Is the user a member of the super group?\n    if (ugi.getGroupsSet().contains(superGroup)) {\n      return;\n    }\n\n    // Not a superuser\n    throw new AccessControlException(\n        ugi.getUserName() + \" is not a super user\");\n  }\n}\n","sourceCodeStart":114,"sourceCodeEnd":136,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-hdfs-project/hadoop-hdfs-rbf/src/main/java/org/apache/hadoop/hdfs/server/federation/router/RouterPermissionChecker.java#L114-L136","documentation":"The final fallback in RouterPermissionChecker.checkSuperuserPrivilege: the caller's UGI is neither the router super user (short name equal to the user running the Router, i.e. its owner) nor a member of the super group (dfs.permissions.superusergroup, default 'supergroup'). The AccessControlException names the rejected user, protecting privileged router operations (admin protocol, setSafeMode, refresh calls, mount table writes).","triggerScenarios":"Any router operation gated by checkSuperuserPrivilege - RouterAdminServer mutations, refresh*/setSafeMode, and similar - issued by a user that is not the router process owner and not in the configured supergroup.","commonSituations":"Ops team members not listed in the supergroup attempting dfsrouteradmin changes; supergroup left at default 'supergroup' which nobody actually belongs to; router run under 'hdfs' while admins use personal accounts; group mapping (LDAP/static mapping) not returning the supergroup for the user.","solutions":["Add the user to dfs.permissions.superusergroup (via group mapping - LDAP/OS/static mapping) so the groups set contains the supergroup","Or run the privileged operation as the user that owns the router process (its short name matches superUser)","Verify effective groups with a groups mapping check (UserGroupInformation.getLoginUser().getGroups()) - stale group cache may need refreshUserToGroupsMappings on the Namenodes","If a different admin group is wanted, set dfs.permissions.superusergroup consistently and restart the router"],"exampleFix":"# before\nhdfs dfsrouteradmin -safemode enter   # as user alice -> 'alice is not a super user'\n# after: put alice in the supergroup (example: static mapping in core-site.xml)\n<property><name>hadoop.user.group.static.mapping.overrides</name><value>alice=alice,supergroup</value></property>\n# or run as the router owner\nsudo -u hdfs hdfs dfsrouteradmin -safemode enter","handlingStrategy":"validation","validationCode":"// Verify superuser status client-side before attempting privileged admin calls\nUserGroupInformation ugi = UserGroupInformation.getCurrentUser();\nString superGroup = conf.get(\"dfs.permissions.superusergroup\", \"supergroup\");\nboolean isSuper = ugi.getShortUserName().equals(routerOwnerShortName)\n    || ugi.getGroupsSet().contains(superGroup);\nif (!isSuper) throw new AccessControlException(ugi.getUserName() + \" is not a super user\");","typeGuard":"boolean isRouterSuperuser(UserGroupInformation ugi, String routerOwner, String superGroup) {\n  return ugi.getShortUserName().equals(routerOwner)\n      || ugi.getGroupsSet().contains(superGroup);\n}","tryCatchPattern":"try {\n  client.getRouterStateManager().setSafeMode(SafeModeAction.ENTER, false);\n} catch (AccessControlException ace) {\n  if (ace.getMessage() != null && ace.getMessage().endsWith(\"is not a super user\")) {\n    // put the acting user in dfs.permissions.superusergroup or run as the router owner\n  }\n  throw ace;\n}","preventionTips":["Manage router admin membership through the supergroup via your group-mapping provider (LDAP/static)","Verify group resolution before granting: check UserGroupInformation groups for the admin account","Run break-glass admin ops as the router owner account and audit them"],"tags":["hdfs","router","federation","superuser","permission-denied","access-control","admin-api"],"backgroundTag":"insufficient-privileges","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}