{"record":{"id":"8a41d5339a73d768","repo":"apache/druid","slug":"the-current-user-s-cannot-view-query-id-s-sinc","errorCode":null,"errorMessage":"The current user[%s] cannot view query id[%s] since the query is owned by another user","messagePattern":"The current user\\[(.+?)\\] cannot view query id\\[(.+?)\\] since the query is owned by another user","errorType":"http","errorClass":"ForbiddenException","httpStatus":403,"severity":"error","filePath":"multi-stage-query/src/main/java/org/apache/druid/msq/sql/resources/SqlStatementResource.java","lineNumber":734,"sourceCode":"    MSQControllerTask msqControllerTask = (MSQControllerTask) taskPayloadResponse.getPayload();\n    String queryUser = String.valueOf(msqControllerTask.getQuerySpec()\n                                                       .getContext()\n                                                       .get(MSQTaskQueryMaker.USER_KEY));\n\n    String currentUser = authenticationResult.getIdentity();\n\n    if (currentUser != null && currentUser.equals(queryUser)) {\n      return msqControllerTask;\n    }\n\n    AuthorizationResult authResult = AuthorizationUtils.authorizeAllResourceActions(\n        authenticationResult,\n        Collections.singletonList(new ResourceAction(Resource.STATE_RESOURCE, forAction)),\n        authorizerMapper\n    );\n\n    if (!authResult.allowAccessWithNoRestriction()) {\n      throw new ForbiddenException(StringUtils.format(\n          \"The current user[%s] cannot view query id[%s] since the query is owned by another user\",\n          currentUser,\n          queryId\n      ));\n    }\n\n    return msqControllerTask;\n  }\n\n  private ResultFormat getPreferredResultFormat(String resultFormatParam, MSQSpec msqSpec)\n  {\n    if (resultFormatParam == null) {\n      return QueryContexts.getAsEnum(\n          RESULT_FORMAT,\n          msqSpec.getContext().get(RESULT_FORMAT),\n          ResultFormat.class,\n          ResultFormat.DEFAULT_RESULT_FORMAT\n      );","sourceCodeStart":716,"sourceCodeEnd":752,"githubUrl":"https://github.com/apache/druid/blob/9b90983fd291f26935af934383ce360473179e4d/multi-stage-query/src/main/java/org/apache/druid/msq/sql/resources/SqlStatementResource.java#L716-L752","documentation":"Thrown by the MSQ SQL statement REST resource when a user requests status/results of a query they do not own and the authorization check for the STATE resource fails. Druid restricts MSQ query introspection to the submitting user (or users with explicit STATE READ permissions), so cross-user access is rejected with HTTP 403.","triggerScenarios":"Calling GET /druid/v2/sql/statements/{queryId} (or its status/results endpoints) as user A when the query was submitted by user B and the authorizer does not grant A read access to the STATE resource.","commonSituations":"Shared clusters where an operator tries to inspect a colleague's query; service accounts querying with a different identity than the UI session; missing STATE READ permission for admin/ops roles after authorizer configuration changes.","solutions":["Query the id with the same user that submitted the query, or re-submit the query under your own account","Grant the current user READ on Resource.STATE_RESOURCE via the authorizer (e.g. add a STATE resource rule/role for the ops role)","Check which identity reached the endpoint (authenticat result) — proxy headers or tiered auth may map the request to an unintended user","If admins should see all queries, configure the authorizer to allow STATE READ for the appropriate role"],"exampleFix":"// before: admin cannot view others' queries\nGET /druid/v2/sql/statements/{id} -> 403 Forbidden\n// after: grant STATE READ in authorizer.json role\n\"role-ops\": {\"resources\": [{\"name\": \"STATE\", \"type\": \"STATE\", \"actions\": [\"READ\"]}], \"statePermissions\": {\"queries\": \"READ\"}}","handlingStrategy":"validation","validationCode":"// client-side: query the statement's status only as the submitting user\nif (!currentUser.equals(statement.getQueryContext().get(\"authUser\"))) {\n  throw new IllegalStateException(\"Query owned by another user; STATE READ required\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Submit and query MSQ statements under a consistent service account","Grant ops/admin roles STATE READ in the authorizer","Be aware of proxy authentication mapping the request to a different identity"],"tags":["msq","authorization","rest-api","forbidden"],"backgroundTag":"permission-denied","analyzedSha":"9b90983fd291f26935af934383ce360473179e4d","analyzedAt":"2026-09-07T13:32:30.957Z","contentChangedAt":"2026-09-07T13:32:30.957Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}