{"record":{"id":"7e3ccf65ba1f9a12","repo":"apache/hadoop","slug":"access-denied-user-does-not-have-permission-to","errorCode":null,"errorMessage":"Access denied: User {} does not have permission to view job {}","messagePattern":"Access denied: User (.+?) does not have permission to view job (.+?)","errorType":"http","errorClass":"RuntimeException","httpStatus":403,"severity":"error","filePath":"hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-app/src/main/java/org/apache/hadoop/mapreduce/v2/app/webapp/AppController.java","lineNumber":427,"sourceCode":"  public void requireJob() {\n    if ($(JOB_ID).isEmpty()) {\n      badRequest(\"missing job ID\");\n      throw new RuntimeException(\"Bad Request: Missing job ID\");\n    }\n\n    JobId jobID = MRApps.toJobID($(JOB_ID));\n    app.setJob(app.context.getJob(jobID));\n    if (app.getJob() == null) {\n      notFound($(JOB_ID));\n      throw new RuntimeException(\"Not Found: \" + $(JOB_ID));\n    }\n\n    /* check for acl access */\n    Job job = app.context.getJob(jobID);\n    if (!checkAccess(job)) {\n      accessDenied(\"User \" + request().getRemoteUser() + \" does not have \" +\n          \" permission to view job \" + $(JOB_ID));\n      throw new RuntimeException(\"Access denied: User \" +\n          request().getRemoteUser() + \" does not have permission to view job \" +\n          $(JOB_ID));\n    }\n  }\n\n  /**\n   * Ensure that a TASK_ID was passed into the page.\n   */\n  public void requireTask() {\n    if ($(TASK_ID).isEmpty()) {\n      badRequest(\"missing task ID\");\n      throw new RuntimeException(\"missing task ID\");\n    }\n\n    TaskId taskID = MRApps.toTaskID($(TASK_ID));\n    Job job = app.context.getJob(taskID.getJobId());\n    app.setJob(job);\n    if (app.getJob() == null) {","sourceCodeStart":409,"sourceCodeEnd":445,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-app/src/main/java/org/apache/hadoop/mapreduce/v2/app/webapp/AppController.java#L409-L445","documentation":"After resolving the job, requireJob checks JobACL.VIEW_JOB: when the authenticated remote user is not the job owner, not listed in mapreduce.job.acl-view-job, and not an admin, the UI sends 403 (accessDenied) and throws this RuntimeException to stop rendering. Unauthenticated requests are not checked here - they fail earlier at authentication.","triggerScenarios":"An SPNEGO/Kerberos-authenticated user opens a job page of an ACL-protected job without view permission: checkAccess(job) returned false in AppController.requireJob (AppController.java:423-428).","commonSituations":"Shared clusters with per-job view ACLs; operators not in mapreduce.cluster.acl.administer; secure clusters where the browser authenticates as a different principal than the one granted access.","solutions":["Ask the job owner to add your user to mapreduce.job.acl-view-job at submission time","Access the page as the job owner or a cluster/queue administrator","For completed jobs, view them through the Job History Server with admin rights"],"exampleFix":"// before: submitted without view ACL\nJob job = Job.getInstance(conf);\n\n// after: owner grants view access at submission\nJob job = Job.getInstance(conf);\njob.getConfiguration().set(\"mapreduce.job.acl-view-job\", \"alice,ops-team\");","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"// UI-side (scrapers): detect the 403 and report a permission problem\ntry {\n  page = fetch(amUrl + \"/job?job.id=\" + jobId);\n} catch (HttpStatusException e) {\n  if (e.getStatusCode() == 403) {\n    throw new AccessDeniedException(\n        \"no VIEW_JOB acl for \" + currentUser + \" on \" + jobId\n        + \" - ask the owner to add you to mapreduce.job.acl-view-job\");\n  }\n  throw e;\n}","preventionTips":["Job owners: set mapreduce.job.acl-view-job explicitly at submission when a job must be visible to others","Authenticate as the job owner when debugging your own jobs","Admins: membership in mapreduce.cluster.acl.administer grants view access cluster-wide"],"tags":["mapreduce","web-ui","http-403","acl","authorization","applicationmaster"],"backgroundTag":"access-denied-403","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}